Skip to content
Agentmart
Submit a tool

MCP Safety Warden

MCP proxy adding security scanning, behavioral profiling, risk gating, and safe tool call execution.

Connector by gautamvarmadatla · GitHub account verified by the MCP Registry

IndexedApache-2.0Local (stdio)★ 8
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/gautamvarmadatla-mcpsafetywarden

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

MCP proxy adding security scanning, behavioral profiling, risk gating, and safe tool call execution.

Use cases: security-scanning

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
15 read · 7 write · 1 delete · 2 not yet classified
Secrets
None asked for
Install scripts
None found
Runs as
Python package

Tools by what they do 25

Read from the source code; the running server may list different tools.

Read 15 · Look things up without changing anything.

  • analyze_cve_blast_radius
  • check_server_drift
  • discover_servers
  • explain_client_risk
  • explain_tool_risk
  • get_retry_policy
  • get_risk_graph
  • get_run_history
  • get_security_scan
  • get_tool_profile
  • inspect_server
  • list_server_tools
Show 3 more tools
  • list_servers
  • ping_server
  • suggest_safer_alternative

Write 7 · Create, change, send or run things.

  • export_graph
  • onboard_discovered_servers
  • preflight_tool_call
  • register_server
  • run_replay_test
  • safe_tool_call
  • set_tool_policy

Delete 1 · Delete, drop, revoke or wipe things.

  • scan_all_servers

Not yet classified 2 · We could not tell from the name and description.

  • onboard_server
  • security_scan_server

Network hosts it talks to 11

  • 169.254.169.254 · found in code
  • api.github.com · found in code
  • api.githubcopilot.com · found in code
  • api.osv.dev · found in code
  • app.snyk.io · found in code
  • github.com · found in code
  • glama.ai · found in code
  • hn.algolia.com · found in code
  • mermaid.live · found in code
  • metadata.google.internal · found in code
  • raw.githubusercontent.com · found in code

Files it touches

  • ~/.aws
  • ~/.aws/credentials
  • ~/.config/gcloud
  • ~/.docker/config.json
  • ~/.env
  • ~/.gnupg
  • ~/.kube
  • ~/.netrc
  • ~/.ssh
  • ~/.ssh/id_rsa
  • ~/AppData/Roaming/Claude/claude_desktop_config.json
  • /etc/ampcode/managed-settings.json
  • /etc/claude-code/managed-mcp.json
  • /etc/passwd
  • /etc/resolv.conf
  • /etc/shadow
  • /etc/ssl
  • /private/etc
  • /private/tmp
  • /private/var/tmp
  • Your home directory (~)
  • ~/.cursor/mcp.json
  • ~/projects
  • Any path the agent passes to its tools

Tools (25)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • analyze_cve_blast_radius

    Report CVEs that affect multiple servers, showing the blast radius across the client's workspace. A single supply-chain vulnerability (e.g. a CVE in the 'requests' library) may be present in several MCP servers simultaneously. This tool surfaces those shared exposures so you can prioritize patching by blast radius rather than server-by-server. client_id: scope to servers under one client; omit to query across all clients. vuln_id: filter to a specific CVE / GHSA / vulnerability ID. BEFORE: inspect_server for each server (provenance must be built to detect CVEs). AFTER: security_scan_server …

  • check_server_drift

    Detect tool schema and tool-list changes since the last inspect_server baseline. Run this periodically or whenever a server may have been updated. CRITICAL/HIGH drift means safe_tool_call may fail for affected tools. MEDIUM drift (description changed) is a prompt-injection risk - re-scan after. Severities: CRITICAL: tool removed (safe_tool_call will error for that tool) HIGH: parameter removed or type changed MEDIUM: description changed (prompt-injection risk) or new required param LOW: new optional param or new tool added update_baseline: True (default) updates baseline after repor…

  • discover_servers

    Scan the local machine for MCP servers configured in known MCP client apps. Checks 20 MCP clients: VS Code, Claude Desktop, Cursor, Windsurf, Zed, Continue, Goose, Cline, Roo Code, Amazon Q, Kiro, GitHub Copilot, Amp, Gemini CLI, OpenCode, Antigravity, Codex CLI, 5ire, Witsy, and more. Does NOT register or execute anything - read-only config file scan. Results are cached in the database; use discovery_id values to onboard specific servers. client: filter to a specific client ID (e.g. "cursor", "claude-desktop", "vscode") include_project: also scan project-level config files in the current w…

  • explain_client_risk

    Analyze cross-server risks for all MCP servers registered under one agent client. Detects risks that are invisible when looking at servers individually: cross_server_exfiltration: read tool on server-A + external tool on server-B - data can leave the system even if each server individually looks safe. tool_shadowing: same tool name on multiple servers - attacker controlling one can intercept calls intended for another. shared_cve_blast_radius: a single supply-chain CVE affects tools across multiple servers. client_id: agent client identifier (e.g. "claude-desktop", "cursor", "v…

  • explain_tool_risk

    Walk the risk graph for a specific tool and return blast radius, risk paths, and recommended action. Returns: blast_radius: critical | high | medium | low | none direct_findings: security scan findings that affect this tool composition_risks: dangerous tool combinations (e.g. read + external_post = exfiltration) risk_paths: human-readable paths from findings to the tool agent_clients: which AI clients have this server configured recommended_action: allow | warn | require_approval | block BEFORE: get_risk_graph (to ensure graph is populated). AFTER: set_tool_policy('block') if rec…

  • export_graph

    Export the risk graph in the requested format. format: "png" (default) - PNG image rendered via mmdc (requires: npm install -g @mermaid-js/mermaid-cli). "mermaid" - Mermaid LR diagram source for pasting into mermaid.live. "json" - structured objects and relations list. server_id: scope export to one server; omit for full workspace graph. output_path: file path for PNG output; defaults to <server_id>_graph.png in the current directory. Graph is rebuilt automatically before export.

  • get_retry_policy

    Get the recommended retry policy for a tool: max retries, backoff strategy, and suggested timeout. Returns policy name ("retry_freely", "no_retry", "retry_once_with_caution"), max_retries, backoff_strategy, and suggested_timeout_ms derived from observed p95 latency. BEFORE: inspect_server (tool must be known). More accurate after several safe_tool_call runs. AFTER: implement retry logic around safe_tool_call using max_retries and backoff_strategy. To verify actual idempotency before relying on retry_safety="safe", run run_replay_test.

  • get_risk_graph

    Return the inventory graph of MCP servers, tools, security findings, and their relationships. The graph exposes connections that preflight_tool_call and safe_tool_call use for blast-radius context. On first call the graph may be empty - pass rebuild=True to populate it from all data Safety Warden has already stored. server_id: scope the graph to one server; omit for the full workspace graph. rebuild: True = rebuild from existing Safety Warden tables before returning. Returns objects (nodes) and relations (edges). Node types: mcp_server, tool, finding, agent_client, mcp_config, credential_…

  • get_run_history

    Get recent execution history for a tool: timestamps, latency, success/fail, and injection warnings. Use this to debug failures, audit executions, or review calls that were quarantined (quarantined=True) by safe_tool_call due to injection signals in the output. BEFORE: safe_tool_call (calls must have been made to have history). AFTER: if injection_warning runs are found, consider set_tool_policy('block').

  • get_security_scan

    Retrieve the latest stored security scan report for a server. If a background scan is running (security_scan_server with background=True), returns status="running" - poll again in ~30 seconds until status is absent. BEFORE: security_scan_server (to start or have completed a scan). AFTER: check tool_findings for HIGH-risk tools, then set_tool_policy('block') as needed.

  • get_tool_profile

    Get the full raw behavior profile for a tool with all observed metrics and confidence scores. Returns latency percentiles, failure rate, output size stats, schema stability, and per-field confidence. More detailed than the summary in list_server_tools. BEFORE: safe_tool_call (at least a few runs build observed stats; before that, data is inferred). Use this to debug unexpected risk classifications or review learned behavioral data.

  • inspect_server

    Re-connect to a registered server, enumerate its tools, classify each one, and update stored profiles. Use this when register_server was called with auto_inspect=False (server was not yet running), or after a server update to refresh tool definitions and risk classifications. BEFORE: register_server or onboard_server (server must be registered). AFTER: run security_scan_server if untrusted; use list_server_tools to review discovered tools. Drift from the previous baseline is reported automatically if a prior snapshot exists. classify_provider: LLM for tool classification ("anthropic"|"opena…

  • list_server_tools

    List all known tools for a server with summarized risk profiles (effect class, retry safety, risk level). Use this before safe_tool_call to choose which tool to call and assess risk. Returns error with hint to run inspect_server if no tools are found. BEFORE: inspect_server (to populate tool profiles). AFTER: safe_tool_call to execute a tool, or set_tool_policy('block') for any HIGH-risk tools.

  • list_servers

    List all registered servers with transport type and tool count. Use this first when you don't know which servers are available, before calling safe_tool_call, security_scan_server, or list_server_tools. NEXT: list_server_tools(server_id) to see available tools on a specific server.

  • onboard_discovered_servers

    Register previously discovered servers into the Safety Warden pipeline (register + inspect). Must call discover_servers first to populate the discovery cache. Skips already-registered servers and servers with only activation_state_only data (5ire). Does NOT run security scans - call security_scan_server after for untrusted servers. discovery_ids: specific discovery_id values from the discover_servers response client: all discovered servers from one client (e.g. "cursor", "claude-desktop", "vscode") all_found: register every unregistered server found in the last discover_servers scan auto_ins…

Show 10 more tools
  • onboard_server

    One-shot server onboarding: register + inspect + security scan in a single call. This is the preferred entry point for adding a new server. Equivalent to register_server then security_scan_server, but handles inspection failures with a source-only fallback. Use register_server directly only when you need to control the steps separately. If inspection fails (stdio server not running) and github_url is provided, runs a source-only scan without registering - review results, fix local setup, then re-run. If inspection fails and no github_url is given, onboarding is aborted with a clear error. c…

  • ping_server

    Check if a registered server is reachable. Returns status and round-trip latency. Use before safe_tool_call if you suspect the server is down, or to diagnose connection errors. For remote (SSE/HTTP) servers, also runs a fast network recon scan via kali_recon. BEFORE: register_server (server must be registered). AFTER: if unreachable, fix local setup then call inspect_server to refresh the tool list.

  • preflight_tool_call

    Get a risk assessment for a tool WITHOUT executing it. DO NOT call this before safe_tool_call - safe_tool_call runs preflight internally. Only use preflight_tool_call when you need to show the user risk details before deciding whether to proceed, separate from actually calling the tool. Returns: effect class, retry safety, risk level, approval_recommended flag, latency band, output size risk, confidence, evidence trail, and security findings. BEFORE: inspect_server (tool must be registered and known). AFTER: if approval_recommended=True, either get user confirmation then call safe_tool_call…

  • register_server

    Register a server so it can be wrapped, profiled, and called via safe_tool_call. Prefer onboard_server for a single trusted server - it does register + security scan + inspect in one call. Use register_server directly only when you want to control the steps separately. transport: "stdio" (local process, supply command+args) | "sse" (legacy remote, supply url) | "streamable_http" (modern hosted, supply url) auto_inspect: connect immediately and discover tools (default true). Set false only if the server is not yet running. headers: auth headers for remote servers, e.g. {"Authorization": "Beare…

  • run_replay_test

    Test idempotency by calling a tool TWICE with identical args and comparing outputs. WARNING: this executes the tool twice and has real side effects for non-read-only tools. The response will indicate if approved=True is required before the test can run. Use this to verify whether a tool is truly safe to retry on failure, confirming or refuting the retry_safety classification returned by get_retry_policy. BEFORE: get_retry_policy (check current retry_safety classification). Only worth running if retry_safety is "safe" or "unknown" - skip for "unsafe". AFTER: if idempotent=True confirmed, rel…

  • safe_tool_call

    Execute a tool through the safety proxy. This is the ONLY correct way to call tools on registered servers. Do NOT call preflight_tool_call before this - preflight runs automatically inside. First call: low-risk tools execute immediately. Medium/high risk returns blocked=True with alternatives. When blocked: approved=True: proceed despite risk (confirm with user first) use_alternative="<tool_name>": execute a safer alternative from the alternatives list show_more_options=True: see all options including abort When blocked by "policy_blocked": use set_tool_policy(policy=None) to clear if…

  • scan_all_servers

    Run the MCPSafety 5-stage security pipeline against all registered servers in one call. Prefer this over looping security_scan_server individually. Results are stored per-server and appear in subsequent preflight_tool_call and safe_tool_call responses. Returns a combined report with per-server results and an aggregate overall_risk_level. BEFORE: inspect_server for each server (tools must be known). Check list_servers first. AFTER: set_tool_policy('block') for HIGH-risk tools; then use safe_tool_call normally. provider: "anthropic" | "openai" | "gemini" | "ollama" (same providers as security…

  • security_scan_server

    Run a security audit on a registered server's tools, or a standalone source-only scan. REQUIRED for any untrusted server before using safe_tool_call. BEFORE: register_server or onboard_server (or pass github_url for source-only mode, no registration needed). AFTER (server_id mode): get_security_scan(server_id) -> set_tool_policy('block') for HIGH-risk tools. AFTER (source-only mode): get_security_scan(github_url) to retrieve results -> review findings -> fix local setup -> re-run onboard_server. set_tool_policy does not apply (no registered server). Two modes:…

  • set_tool_policy

    Set a permanent execution policy for a tool, overriding the normal preflight flow. Use "block" after security_scan_server reveals a HIGH-risk tool you never want called. Use "allow" for trusted internal tools where you want to skip risk checks for speed. Use null to restore the normal safe_tool_call preflight behavior. policy: "allow" - always execute without preflight check. "block" - never execute; safe_tool_call returns blocked=True immediately. null - clear policy; resume normal risk-gated preflight flow. BEFORE: security_scan_server or get_security_scan (to identify …

  • suggest_safer_alternative

    Find lower-risk alternatives to a tool on the same server, ranked by risk reduction. Call this when safe_tool_call returns blocked=True and you want safer substitutes. Returns alternatives with risk_reduction (HIGH/MEDIUM/LOW), functional_coverage, why_safer, and what_it_loses for informed trade-off decisions. LLM path (default): semantic matching using effect_class ordering and security findings. Auto-detects provider from ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY. Rule-based fallback: name-stem matching for read-only tools; used when no LLM is available. BEFORE: safe_tool_call (bl…

Compare and alternatives

    Featured in

    Signals

    Stars
    8
    Forks
    2
    Open issues
    2
    Weekly downloads
    834
    Last commit
    Oct 24, 2026 (4 days ago)
    Last release
    Oct 19, 2026 (10 days ago)
    Last package publish
    Oct 24, 2026 (4 days ago)

    From GitHub (fetched Oct 24, 2026) and the package registry.

    Details

    Registry name
    io.github.gautamvarmadatla/mcpsafetywarden
    Version
    1.5.0
    Auth
    No auth
    Packages
    pypi mcpsafetywarden
    License
    Apache-2.0
    Repository
    github.com/gautamvarmadatla/mcpsafetywarden
    First seen
    Oct 24, 2026
    Last checked
    Oct 24, 2026
    Source
    Official MCP Registrygithub-graphql
    Cite this page

    MCP Safety Warden. Agent Mart. https://agentmart.dev/connectors/gautamvarmadatla-mcpsafetywarden (last updated 2026-10-24)