Bypassing iron-proxy's MCP Tool Allowlist With a Content-Type Header

iron-proxy is an egress proxy to manage traffic for untrusted workloads. It works as a MITM proxy, has a DNS server and can apply an allowlist on MCP tool calls. While trying to sandbox an agent with docker, I added iron-proxy as a container to route all the traffic through it. The idea was to have agent and MCP each in their own containers and isolated networks, both communicating through the proxy. The proxy was the only container having outbound internet access. Either all the workloads had to go through the proxy, which only allowed access to domains and MCP tools explicitly whitelisted, or were dropped. I discovered that iron-proxy only enforces the MCP tool call allowlist when the Content-Type header matches application/json. This means an agent can send a JSON-RPC body for a denied tool with a different Content-Type header and it can be executed. Disclosure: AI agents were used to test the behaviour across multiple MCP server implementations, content types and iron-proxy…