Guardian Shield

AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs

Connector by sparkvibe-io · GitHub account verified by the MCP Registry

IndexedApache-2.0Local (stdio)★ 3

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/sparkvibe-io-guardianshield

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools: 19 read · 5 write · 1 delete · 2 not yet classified
Secrets: None asked for
Install scripts: Not scanned yet
Runs as: Python package

Tools by what they do 27

Read from the source code; the running server may list different tools.

Read 19 · Look things up without changing anything.

audit_log
check_dependencies
check_quality_gate
check_secrets
get_findings
get_profile
list_engines
list_false_positives
parse_manifest
scan_code
scan_dependencies
scan_diff

Show 7 more tools

scan_directory
scan_file
scan_files
scan_input
scan_output
scan_with_baseline
shield_status

Write 5 · Create, change, send or run things.

mark_false_positive
save_baseline
set_engine
set_profile
sync_vulnerabilities

Delete 1 · Delete, drop, revoke or wipe things.

unmark_false_positive

Not yet classified 2 · We could not tell from the name and description.

export_sarif
test_pattern

Secrets and settings it asks for

Other settings (environment variables or headers).

GUARDIANSHIELD_AUDIT_PATH
GUARDIANSHIELD_DEBUG
GUARDIANSHIELD_PROFILE

Files it touches

Any path the agent passes to its tools

Tools (27)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

audit_log
Query the security audit log. Returns recent scan events with timestamps, scan types, finding counts, and input hashes.
check_dependencies
Check package dependencies for known vulnerabilities using the OSV.dev database. Provide a list of packages with names, versions, and ecosystems (PyPI or npm).
check_quality_gate
Scan code and evaluate findings against configurable severity thresholds. Returns a pass/fail/warn verdict suitable for CI pipelines. Exit codes: 0=pass, 1=fail.
check_secrets
Dedicated secret and credential detection. Scans text for AWS keys, GitHub tokens, Stripe keys, private keys, JWTs, Slack tokens, passwords, connection strings, Google API keys, and more. All matched secrets are redacted in findings.
export_sarif
Export scan findings as SARIF 2.1.0 JSON for GitHub Code Scanning, VS Code, and CI integration
get_findings
Retrieve past security findings from the audit database with optional filters by type, severity, or audit ID.
get_profile
Get the current safety profile configuration including scanner settings and blocked content categories.
list_engines
List available analysis engines with their capabilities and enabled status. Returns each engine's name, whether it is enabled in the current profile, and its capabilities.
list_false_positives
List active false positive records. Shows findings that have been marked as false positives, with optional filtering by scanner.
mark_false_positive
Mark a security finding as a false positive. The finding will be flagged in future scans, and similar patterns at other locations will be annotated as potential false positives.
parse_manifest
Parse a dependency manifest file into a structured list of dependencies. Auto-detects format from the filename. Supports: requirements.txt, package.json, pyproject.toml, package-lock.json, yarn.lock, pnpm-lock.yaml, Pipfile.lock, go.mod, go.sum, composer.json, composer.lock.
save_baseline
Scan code and save the findings as a baseline JSON file. On subsequent scans with scan_with_baseline, only NEW findings (not in the baseline) are reported.
scan_code
Scan source code for security vulnerabilities (SQL injection, XSS, command injection, path traversal) and hardcoded secrets/credentials. Returns a list of findings with severity, type, and remediation guidance.
scan_dependencies
Recursively scan a directory for manifest/lockfiles (requirements.txt, package.json, go.mod, composer.json, etc.), parse dependencies, and check them for known vulnerabilities using the OSV.dev database.
scan_diff
Scan a unified diff (e.g. from git diff) for vulnerabilities. Only added lines are scanned; findings have correct line numbers and file paths from the diff context.

Show 12 more tools

scan_directory
Recursively scan a directory for vulnerabilities and secrets. Supports extension filtering, exclude patterns, and reports progress. Returns all findings across all scanned files.
scan_file
Scan a single source file for vulnerabilities and secrets. Auto-detects language from file extension. Returns findings with line numbers, severity, CWE IDs, and remediation.
scan_files
Scan multiple files in one call. Returns findings grouped by file with a summary of total findings.
scan_input
Check user or agent input for prompt injection attempts. Detects instruction override, role hijacking, system prompt extraction, delimiter abuse, ChatML injection, jailbreak keywords, and encoding evasion.
scan_output
Check AI-generated output for PII leaks (email, SSN, credit card, phone, IP) and content policy violations (violence, self-harm, illegal activity). PII is automatically redacted in findings.
scan_with_baseline
Scan code and compare against a saved baseline, returning only NEW findings that are not in the baseline. Use save_baseline first to create a baseline.
set_engine
Set which analysis engines are active for code scanning. Accepts a list of engine names to enable for the current session. Available engines can be listed with list_engines.
set_profile
Switch to a different safety profile. Available profiles: general, education, healthcare, finance, children. Each profile adjusts scanner sensitivity and blocked categories.
shield_status
Get GuardianShield health and configuration status including active profile, enabled scanners, and audit statistics.
sync_vulnerabilities
Sync the local OSV vulnerability database for a given ecosystem. Call this to update the cache before checking dependencies.
test_pattern
Test a regex pattern against sample code. Returns match details including positions and matched text. Useful for developing and debugging custom vulnerability patterns.
unmark_false_positive
Remove a false positive record by its fingerprint. The finding will no longer be flagged in future scans.

Signals

Stars: 3
Forks: 2
Open issues: 2
Weekly downloads: 24
Last commit: Mar 3, 2026 (8 months ago)
Last release: Mar 3, 2026 (8 months ago)
Last package publish: Mar 3, 2026 (8 months ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name: io.github.sparkvibe-io/GuardianShield
Version: 1.2.1
Auth: No auth
Packages: pypi guardianshield
License: Apache-2.0
Repository: github.com/sparkvibe-io/GuardianShield
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql