Bastion MCP Server: Install & Setup

Install Bastion in Claude Code

Claude Code

claude mcp add gowthaman90-bastion -- npx -y mcp-bastion

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "gowthaman90-bastion": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-bastion"
      ]
    }
  }
}

Frequently asked questions

What does the Bastion MCP server do?

Security proxy for MCP servers: tool-definition pinning, tool-poisoning and exfiltration detection, injection blocking, secret redaction and audit trails.

Is the Bastion MCP server free?

Yes, most likely. Open source and no paid account or API key is mentioned in the listing. Check the provider for current pricing.

Does Bastion run locally or remotely?

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

How do I add Bastion to Claude Code?

Run: claude mcp add gowthaman90-bastion -- npx -y mcp-bastion

More security & identity MCP servers

View all

CodeInspectus

50968

Synvoya/codeinspectus

Local security scanner for AI-generated JS/TS that combines Opengrep, Gitleaks and Trivy with checks for exposed secrets, Supabase RLS and prompt injection.

LocalFreeTypeScript

Database Sentinel

Farenhytee/database-sentinel

Read-only security audit for Supabase. Four tools surface RLS gaps, permissive policies, exposed functions and grants; an audit prompt returns scored findings with fix SQL.

LocalAccount neededPython

Authenticator

firstorderai/authenticator_mcp

Securely interact with the Authenticator App.

LocalFreeTypeScript

Security

fr0gger/MCP_Security

Query the ORKL API to fetch threat reports, analyze threat actors and retrieve intelligence sources.

LocalAccount neededTypeScript

Keycloak

sshaaf/keycloak-mcp-server

designed to work with Keycloak for identity and access management, with about 40+ tools covering, Users, Realms, Clients, Roles, Groups, IDPs, Authentication. Native builds available.

LocalFree

Volatility

Gaffx/volatility-mcp

Memory forensics with Volatility 3, exposing plugins such as pslist and netscan through REST APIs.

LocalFree