JetBrains MCP Security: Scanning with Pipelock

JetBrains MCP security starts with scanning what flows between your IDE and MCP servers. Pipelock wraps Junie MCP server configurations through its MCP proxy, scanning all tool calls and responses bidirectionally. Works with IntelliJ IDEA, PyCharm, WebStorm, GoLand, and any JetBrains IDE that uses Junie.

What’s new in recent releases

JetBrains integration is pure MCP proxy wrapping, which unlocks the current signed-evidence surface when receipt signing is configured:

• Mediator-signed action receipts for MCP decisions (v2.2.0). With flight_recorder.signing_key_path set in the pipelock config, each proxied Junie MCP decision emits a chained Ed25519 receipt on the mcp_stdio transport.
• Cross-implementation verifier (v2.2.0). Receipts verify byte-for-byte against a published Python verifier using a conformance suite. The receipt format is open, not a vendor artifact.
• RFC 9421 mediation envelope signing (v2.2.0). If a Junie config routes to a remote MCP server over HTTP/SSE, every request carries an Ed25519 Pipelock-Mediation signature with a canonical policy hash.
• Posture verify CI gate (v2.2.0). pipelock posture verify gates deploys with distinct exit codes: 0 pass, 1 could not complete, 2 verified but failed.
• Class-preserving redaction on tools/call arguments (v2.3.0). With the redaction section enabled in the pipelock config, matched secrets in params.arguments are rewritten in place with typed placeholders like <pl:aws-access-key:1> before forwarding to the MCP server. Runs on Pipelock’s MCP proxy transports. Irreversible. Fail-closed on parse errors. Tool responses are not redacted in v1.

See the action receipt spec for the receipt format and the AI agent data redaction guide for redaction rollout.

Quick Start

# Install pipelock
go install github.com/luckyPipewrench/pipelock/cmd/pipelock@latest
# Homebrew alternative on macOS/Linux: brew install luckyPipewrench/tap/pipelock

# Wrap all Junie MCP servers
pipelock jetbrains install

# Restart your JetBrains IDE

Verify protection with pipelock discover.

What Gets Scanned

Once installed, pipelock sits between your IDE and every MCP server:

JetBrains IDE  <-->  pipelock mcp proxy  <-->  MCP Server
  (Junie)            (scan both directions)     (subprocess)

All scanning and policy layers apply: DLP pattern matching, prompt injection detection, tool poisoning checks, tool policy with shell-obfuscation detection, chain detection, and session binding. From Pipelock v2.3.0, request-side redaction also rewrites matched secrets in tools/call params.arguments before forwarding. When receipt signing is configured, every decision emits a signed action receipt (see Proof below).

Install Options

# User-level (default)
pipelock jetbrains install

# Project-level (current directory only)
pipelock jetbrains install --project

# Preview changes without writing
pipelock jetbrains install --dry-run

# Use a specific config
pipelock jetbrains install --config ~/.config/pipelock/pipelock.yaml

How It Works

jetbrains install reads ~/.junie/mcp/mcp.json, wraps each MCP server through pipelock mcp proxy, and writes the modified config back. Original configs are stored in a _pipelock metadata field for clean removal.

Stdio servers get their command wrapped:

// Before
{"command": "node", "args": ["server.js"]}

// After
{"command": "pipelock", "args": ["mcp", "proxy", "--", "node", "server.js"]}

Environment variables from env blocks are passed through automatically via --env KEY flags.

Remove

# Restore original configs
pipelock jetbrains remove

# Preview first
pipelock jetbrains remove --dry-run

Proof: a real signed block receipt

A real receipt from a blocked prompt-injection response, captured by the examples/tool-response-injection/demo.py harness in the Pipelock repo:

{
  "v": 1, "seq": 1,
  "ts": "2026-04-10T14:54:42.323260257Z",
  "session_id": "proxy",
  "type": "action_receipt",
  "transport": "mcp_stdio",
  "summary": "receipt: block unclassified mcp_stdio",
  "detail": {
    "action_record": {
      "verdict": "block",
      "transport": "mcp_stdio",
      "layer": "mcp_response_scan",
      "pattern": "Prompt Injection",
      "policy_hash": "b28d3f9f54e2f6420b2d69989868c9ee08afac69c39ebd70ab555c01ea72a3cf",
      "chain_prev_hash": "23f7168a500c8d8c2f50194b340082af16cb14955df3d31b9a14dc3ad64cb3b8",
      "chain_seq": 1
    },
    "signature":  "ed25519:fed7f683db09bb57…",
    "signer_key": "6b4f13acbab4498026e270a8d66e0ef87a8b20708089f173023234580f35de1c"
  }
}

verdict, layer, and pattern record what and why. chain_prev_hash + chain_seq link this receipt to the prior one. signature + signer_key let anyone verify with the public key alone. Full format: action receipt spec.

Limitations

• Header passthrough: HTTP/SSE servers with custom headers cannot be wrapped yet. Use environment variable authentication instead.
• Project-local configs are not visible to pipelock discover. The default user-level install is visible.
• IDE restart required after install or remove.

See also: Claude Code · Cursor · VS Code · Zed · Full documentation