Building a Zero-Dependency MCP Server with 22 Security Layers in Go

Description and use

A fully self‑contained MCP server in Go with 22 security layers and zero external dependencies, including a neural model for adversarial prompt detection, enabling air‑gapped deployment.

Problem

Implement an MCP server that is air‑gapped, has zero external Go dependencies, and includes a neural ML inference pipeline for adversarial prompt detection.

Outcome

The project delivers a secure, air‑gapped MCP server with zero external Go dependencies, 22 security layers, and optional neural ML inference, at the cost of an 80 MB repository and two build modes.

Workflow

• 1. Design server architecture with 22 security layers and zero external dependencies.
• 2. Vendor all required libraries: HTTP routing, JSON‑RPC, SSE, regex, ONNX Runtime binaries, and the ONNX model.
• 3. Implement ML inference via CGO calling vendored ONNX Runtime; provide heuristic‑only fallback when CGO disabled.
• 4. Build two binaries: static (CGO disabled) and full ML (CGO enabled).
• 5. Implement session management with 30‑minute idle expiry, 256‑bit session IDs, and DELETE for termination.
• 6. Deploy by cloning repo on an air‑gapped machine and running make build or make build-cgo.
• 7. Use the server to handle MCP requests over JSON‑RPC with optional SSE streaming.
• 8. Monitor and maintain the 80 MB repository size due to vendored binaries.
• 9. Document trade‑offs and security considerations.
• 10. Release the code under an open‑source license.
• 11. Future work: add background cleanup or more ML models.
• 12. Evaluate security posture and performance.
• 13. Iterate on architecture as needed.

Evidence

The hardest constraint wasn’t security — it was zero external Go module dependencies.

Source

We vendor the ONNX Runtime shared libraries directly: lib/amd64/libonnxruntime.so # 28MB - vendored binary libonnxruntime.so.1 # symlink LICENSE

Source

When CGO is disabled, the ML layer falls back to heuristic‑only detection. When enabled, you get the full neural net.

Source

Key design decisions: 404 for invalid sessions, not 401.

Source