MCP Security Guard

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/petrovicistefan-mcp-security-guard

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

10 read · 7 write · 0 delete

Secrets

None asked for

Install scripts

Not scanned yet

Runs as

Node.js package

Tools (17)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• adversarial_testAdversarial test of your own MCP server

  CALLS every non-destructive tool of one configured server with command-injection payloads (each would only create an empty canary file) and path-traversal payloads, then reports which parameters reach a shell or the file system unchecked. Only for servers the user develops or operates, ideally a test instance in a container. Destructive tools are skipped unless include_destructive is true.

• analyze_tool_definitionsAnalyze tool definitions (offline)read-only

  Runs the tool-poisoning checks on tool definitions you pass in (e.g. the output of tools/list from a server you are developing), without connecting to anything. Useful in CI or before publishing an MCP server.

• apply_fixesApply recommended fixes

  Fixes findings in the project's own files. permissions: adds the recommended permissions.ask rules for tools that execute code, delete data or write files to .claude/settings.json (needs confirm_launch, because the servers are listed to classify their tools). pin-versions: pins unpinned npx/uvx packages in .mcp.json to the registry's current version (needs confirm_network). env-refs: replaces literal secrets in .mcp.json env/headers with ${VAR} references. Without write=true it only shows the planned edits. Every written file is backed up under ~/.claude/mcp-security/backups/ first; ~/.claude.…

• audit_agent_contextAudit skills, commands, agents and CLAUDE.mdread-only

  Scans the text files Claude reads besides MCP tools: CLAUDE.md, skills (and their bundled scripts), slash commands, subagents, rules and the hook configs of installed plugins, from the user, the project and every enabled plugin. Flags instruction overrides, requests to hide things from the user, invisible text, HTML comments addressed to the model, directives to read credential files, commands that upload credentials, download-and-run and encoded execution, credential-stealing scripts, and pre-approved unrestricted shell access. Read-only; launches nothing and sends nothing.

• audit_mcp_configAudit MCP configurationread-only

  Static audit of MCP server configuration: plaintext secrets in env/headers/args/URLs, plain-HTTP remote servers, unpinned npx/uvx packages, unpinned or privileged Docker containers, pipe-to-shell launch commands, and duplicate server names across scopes. Read-only; launches nothing.

• audit_server_toolsAudit MCP tool definitionsread-only

  Connects to the selected MCP servers, lists their tools, and checks every name, description and schema string for tool poisoning (instruction overrides, concealment requests, hidden tags, invisible Unicode, sensitive file paths, exfiltration wording, encoded payloads), cross-server tool shadowing, and changes since the tools were last pinned (rug pulls). Never calls the scanned tools.

• check_supply_chainCheck MCP server packages (npm/PyPI)read-only

  For servers launched with npx/uvx and similar, checks the package on its registry and in the OSV database: known vulnerabilities, known malicious versions, typosquats of popular MCP packages, non-existent names, very new packages or releases, install scripts, deprecation and npm publisher changes. Sends package names and versions to registry.npmjs.org, pypi.org and api.osv.dev; nothing else leaves the machine.

• export_bomExport the agent bill of materialsread-only

  Inventory of everything the agent can run or read here: MCP servers, plugins, skills, commands, subagents, CLAUDE.md and hook configs, with SHA-256, pin status, scores and OWASP MCP Top 10 evidence. format=summary is a Markdown overview for audits; format=cyclonedx is a CycloneDX 1.6 JSON document. Static and local: nothing is launched or sent, and it holds no paths, arguments, environment or secrets.

• generate_policyGenerate an approved-server policyread-only

  Returns a .mcp-security.json policy that approves exactly the MCP servers configured now (and their remote hosts) and requires pinned versions. Commit it to the repository so CI, session checks and audits flag any server added later that is not on the list (shadow MCP servers). Read-only: returns the JSON, does not write it.

• list_mcp_serversList configured MCP serversread-only

  Lists every MCP server configured for this project (user, local and project scope in Claude Code, plus Claude Desktop) with its transport. Reads config files only; launches nothing.

• pin_contextPin skills, commands, agents and CLAUDE.md

  Records a SHA-256 of every skill, command, subagent, rule, CLAUDE.md, plugin hook config and bundled script (user, project and each installed plugin) in ~/.claude/mcp-security/context-pins.json, so later scans and the session-start check report anything that changed after you approved it. A plugin that changes files without a new version is the rug-pull pattern. Pin only after the user has reviewed an audit_agent_context report; origins with critical or high findings are skipped unless force is true. Reads files only; launches nothing.

• pin_toolsPin MCP tool definitions

  Records a SHA-256 hash of every tool definition of the selected servers in ~/.claude/mcp-security/pins.json, so later audits can detect rug pulls. Pin only after the user has reviewed an audit_server_tools report for these servers. Launches the servers like audit_server_tools.

• query_audit_logQuery the MCP call audit logread-only

  Summarises the local audit log written by the plugin's hooks: MCP tool calls per server and tool, and every call where a credential was sent, a credential came back, or the output contained injected instructions. The log stores hashes and sizes only, never arguments or outputs.

• request_approvalAsk the admin to approve a server or plugin

  Creates an approval request in the user's organisation for an MCP server (e.g. project:linear) or a plugin, when the team policy blocks it or does not list it. Use it only when the user asks. The admin decides on the command line; this tool cannot approve anything.

• security_dashboardSecurity dashboardread-only

  Opens the interactive mcp-security-guard dashboard: every configured MCP server with its score and grade, findings filterable by severity and server, the OWASP MCP Top 10 breakdown, recommended permission rules, and pin buttons. scan='config' reads files only. scan='full' starts the servers to list their tools, prompts and resources (no tool is called) and needs confirm_launch=true; ask the user first.

Signals

Stars

0

Forks

0

Open issues

3

Last commit

Oct 23, 2026 (5 days ago)

Last release

Oct 19, 2026 (9 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

io.github.petrovicistefan/mcp-security-guard

Version

0.9.1

Auth

No auth

Packages

npm mcp-security-guard

License

MIT

Repository

github.com/petrovicistefan/mcp-security-guard

Website

github.com/petrovicistefan/mcp-security-guard#readme

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql