WARDEN — MCP Security Firewall MCP server

Read from the package source without running it. The installed server may list more.

• canonicalize_json

  Return the RFC 8785 JSON Canonicalization Scheme serialization WARDEN uses for threat-feed signatures and tool-def pins, so another implementation can byte-check against it. Integers only inside ±(2^53−1); lone surrogates and non-integers are refused with a reason code, not escaped.

• check_egress_url

  Ask EgressGuard whether a URL's hostname is on an operator allowlist. A tool reaching a host you never listed is the classic phone-home tell. Empty allowlist blocks everything (fail-closed), not everything-allowed.

• classify_sensitive_tools

  Split advertised tool names into sensitive vs safe using the operator's case-insensitive * globs (the same policy.sensitiveToolPatterns a host would use). Sensitive tools stay advertised; they require per-call approval — this tool does not run them.

• list_scan_rules

  Return the in-force static-scan ruleset: version, digest, and every rule's code, severity, tier (block vs advise), surfaces (name / description / inputSchema), optional regex source, and named guards. A recorded verdict is only reproducible together with this identity.

• static_scan_toolswrite action

  Run only the static-scan gate (ruleset v4, 25 signatures with context guards) over advertised tool names, descriptions, and input schemas. Returns findings, a 0..1 gate score, and the published ruleset digest.

• vet_mcp_serverwrite action

  Run WARDEN's ordered gate chain (static-scan → threat-feed → origin → pinning) over a server identity plus its advertised tools/list payload and return a recordable verdict (allow/block, 0..1 product score, findings, allowedTools/blockedTools, ruleset digest).

• Code scan29 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 15 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

WARDEN — MCP Security Firewall: common questions

Is WARDEN — MCP Security Firewall MCP server safe?

Yes, by our scan: it is graded A (92/100). Read the WARDEN — MCP Security Firewall safety report

How do I install WARDEN — MCP Security Firewall?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does WARDEN — MCP Security Firewall need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is WARDEN — MCP Security Firewall maintained?

The last commit was 15 days ago (2026-09-05). The latest release is v0.5.0.

What can I use instead of WARDEN — MCP Security Firewall?

Servers from other publishers that do the same job: MCP server, HOL Guard MCP server and Dvalincode MCP server. Compare all WARDEN — MCP Security Firewall alternatives.