MCP Security Guard MCP server

Read from the package source without running it. The installed server may list more.

• adversarial_test

  CALLS every non-destructive tool of one configured server with command-injection payloads (each would only create an empty canary file) and path-traversal payloads, then reports which parameters reach a shell or the file system unchecked. Only for servers the user develops or operates, ideally a test instance in a container. Destructive tools are skipped unless include_destructive is true.

• analyze_tool_definitionswrite action

  Runs the tool-poisoning checks on tool definitions you pass in (e.g. the output of tools/list from a server you are developing), without connecting to anything. Useful in CI or before publishing an MCP server.

• apply_fixes

  Fixes findings in the project's own files. permissions: adds the recommended permissions.ask rules for tools that execute code, delete data or write files to .claude/settings.json (needs confirm_launch, because the servers are listed to classify their tools). pin-versions: pins unpinned npx/uvx packages in .mcp.json to the registry's current version (needs confirm_network). env-refs: replaces lite

• audit_agent_context

  Scans the text files Claude reads besides MCP tools: CLAUDE.md, skills (and their bundled scripts), slash commands, subagents, rules and the hook configs of installed plugins, from the user, the project and every enabled plugin. Flags instruction overrides, requests to hide things from the user, invisible text, HTML comments addressed to the model, directives to read credential files, commands tha

• audit_mcp_config

  Static audit of MCP server configuration: plaintext secrets in env/headers/args/URLs, plain-HTTP remote servers, unpinned npx/uvx packages, unpinned or privileged Docker containers, pipe-to-shell launch commands, and duplicate server names across scopes. Read-only; launches nothing.

• audit_server_tools

  Connects to the selected MCP servers, lists their tools, and checks every name, description and schema string for tool poisoning (instruction overrides, concealment requests, hidden tags, invisible Unicode, sensitive file paths, exfiltration wording, encoded payloads), cross-server tool shadowing, and changes since the tools were last pinned (rug pulls). Never calls the scanned tools.

• check_supply_chain

  For servers launched with npx/uvx and similar, checks the package on its registry and in the OSV database: known vulnerabilities, known malicious versions, typosquats of popular MCP packages, non-existent names, very new packages or releases, install scripts, deprecation and npm publisher changes. Sends package names and versions to registry.npmjs.org, pypi.org and api.osv.dev; nothing else leaves

• export_bom

  Inventory of everything the agent can run or read here: MCP servers, plugins, skills, commands, subagents, CLAUDE.md and hook configs, with SHA-256, pin status, scores and OWASP MCP Top 10 evidence. format=summary is a Markdown overview for audits; format=cyclonedx is a CycloneDX 1.6 JSON document. Static and local: nothing is launched or sent, and it holds no paths, arguments, environment or secr

• generate_policy

  Returns a .mcp-security.json policy that approves exactly the MCP servers configured now (and their remote hosts) and requires pinned versions. Commit it to the repository so CI, session checks and audits flag any server added later that is not on the list (shadow MCP servers). Read-only: returns the JSON, does not write it.

• list_mcp_servers

  Lists every MCP server configured for this project (user, local and project scope in Claude Code, plus Claude Desktop) with its transport. Reads config files only; launches nothing.

• pin_context

  Records a SHA-256 of every skill, command, subagent, rule, CLAUDE.md, plugin hook config and bundled script (user, project and each installed plugin) in ~/.claude/mcp-security/context-pins.json, so later scans and the session-start check report anything that changed after you approved it. A plugin that changes files without a new version is the rug-pull pattern. Pin only after the user has reviewe

• pin_tools

  Records a SHA-256 hash of every tool definition of the selected servers in ~/.claude/mcp-security/pins.json, so later audits can detect rug pulls. Pin only after the user has reviewed an audit_server_tools report for these servers. Launches the servers like audit_server_tools.

• query_audit_log

  Summarises the local audit log written by the plugin's hooks: MCP tool calls per server and tool, and every call where a credential was sent, a credential came back, or the output contained injected instructions. The log stores hashes and sizes only, never arguments or outputs.

• request_approvalwrite action

  Creates an approval request in the user's organisation for an MCP server (e.g. project:linear) or a plugin, when the team policy blocks it or does not list it. Use it only when the user asks. The admin decides on the command line; this tool cannot approve anything.

• security_dashboard

  Opens the interactive mcp-security-guard dashboard: every configured MCP server with its score and grade, findings filterable by severity and server, the OWASP MCP Top 10 breakdown, recommended permission rules, and pin buttons. scan='config' reads files only. scan='full' starts the servers to list their tools, prompts and resources (no tool is called) and needs confirm_launch=true; ask the user f

• team_report

  Shows exactly what a fleet report would send (server names, scopes, transport, package names and versions or remote hostnames, pinned or not; plugin names and versions; never paths, arguments, environment, headers or secrets). With confirm_send=true it sends it, if the admin turned fleet visibility on. Only when the user asks.

• team_status

  Syncs the organisation's policy from the team backend (it is then enforced next to the user's own policy) and shows the organisation, the role, the policy version and whether fleet reporting is on. Needs a team API key (MCP_SECURITY_API_KEY or the plugin's setting). Sends only the API key; the answer is cached locally.

• Code scan5 source files scanned20/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 0 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

MCP Security Guard: common questions

Is MCP Security Guard MCP server safe?

Yes, by our scan: it is graded A (85/100). Read the MCP Security Guard safety report

How do I install MCP Security Guard?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does MCP Security Guard need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is MCP Security Guard maintained?

The last commit was 4 days ago (2026-10-09). The latest release is v0.9.0.

What can I use instead of MCP Security Guard?

Servers from other publishers that do the same job: Safeinstall MCP server, Wireshark MCP server and Mastyf AI MCP server. Compare all MCP Security Guard alternatives.