Lasso Security MCP: What It Offers, Pricing and Alternatives

Lasso Security sells an AI security platform, and MCP is one of the risks it covers. Lasso says it finds MCP servers across a company, scores their risk, watches tool calls for prompt injection, and masks sensitive data before it leaves. It also publishes an open-source MCP Gateway that filters secrets and personal data in MCP traffic.

Checked against: Lasso's MCP security page on 28 October 2026. eSEOspace did not test Lasso Security's products.

At a glance

What Lasso Security offers for MCP

The platform

Lasso's MCP security page lists these features:

• MCP server discovery. Finds MCP servers across the company and gives each a risk score.
• Runtime monitoring. Watches tool calls in real time for indirect prompt injection.
• Tool description scanning. Checks for hidden instructions, the pattern behind tool poisoning.
• Data loss prevention. Detects sensitive data in tool calls and can "mask sensitive contents before they reach external servers."
• Access management. Controls which users and teams can reach which MCP servers.
• Audit trails. Logs connections and tool calls, with export to a SIEM.

Policies can block, alert or sanitize. Lasso says it uses "intent-aware policies." The page tells you to route MCP connections through the Lasso gateway, but it does not describe the architecture or install steps for the commercial product.

The open-source MCP Gateway

Lasso's MCP Gateway is a local proxy that sits between your AI app and your other MCP servers. Its README says it:

1. Reads server settings from your mcp.json file.
2. Manages the lifecycle of those servers.
3. Intercepts requests and responses "to sanitize sensitive information."
4. Gives one interface to all proxied servers.
5. Runs a security scanner that "analyzes server reputation and security risks before loading MCP servers."

You add features with plugins. The basic plugin masks tokens such as GitHub, AWS and Slack keys. A presidio plugin masks personal data, and a lasso plugin uses Lasso's own API. The README shows Cursor as an example client.

Who it's for

The platform fits security teams at companies where staff use AI coding tools and assistants with MCP. Its main value is seeing which servers are in use and catching risky data or instructions in traffic.

The open-source gateway fits a developer or small team that wants basic secret masking on a laptop without buying a platform.

Pricing

Lasso does not publish pricing for its platform as of October 2026. Its site offers "Book a Demo" and "Get a Free Assessment."

The MCP Gateway is free and open source under the MIT license. The optional lasso plugin calls Lasso's API, so check terms before you use it.

Security and trust

Lasso's MCP page lists support for frameworks such as the NIST AI RMF, OWASP, MITRE and the EU AI Act. It also names SOC 2 Type 2, ISO 27001 and ISO 42001 in a list of frameworks it helps with. The page does not say whether Lasso itself holds those certifications, and its information security policy page had no details on 28 October 2026. Ask Lasso for its own reports.

Alternatives

• Invariant Labs, now part of Snyk, offers scanning and rule-based guardrails.
• Astrix Security offers discovery of managed and shadow MCP servers.
• Pomerium offers an identity-aware proxy with per-tool allow and deny rules.

Next step

Compare runtime guards and scanners in our MCP security tools list. Then read about cross-server data leakage, the risk data masking helps with. You can find other vendors in our MCP companies hub.

Frequently asked questions