# GuardianShield [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/sparkvibe-io/GuardianShield  
**GitHub Stars:** 3  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/guardianshield

## Description
AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs

## Tools
Capabilities this server exposes over MCP:

- **scan_code** — Scan source code for vulnerabilities and hardcoded secrets
- **scan_file** — Scan a single file (auto-detects language from extension)
- **scan_directory** — Recursively scan a directory with filtering and progress streaming
- **scan_input** — Check user/agent input for prompt injection attempts
- **scan_output** — Check AI output for PII leaks and content violations
- **check_secrets** — Detect hardcoded secrets and credentials
- **scan_files** — Scan multiple files in one call
- **scan_diff** — Parse unified diff and scan only added lines
- **check_dependencies** — Check packages for known CVEs via OSV.dev (PyPI, npm, Go, Packagist)
- **sync_vulnerabilities** — Sync the local OSV vulnerability database
- **parse_manifest** — Parse any supported manifest file (11 formats) into dependency objects
- **scan_dependencies** — Scan a directory for manifest files and check all deps for vulnerabilities
- **mark_false_positive** — Mark a finding as false positive (flags future matches)
- **list_false_positives** — List active false positive records with optional filter
- **unmark_false_positive** — Remove a false positive record by fingerprint
- **list_engines** — List available analysis engines with capabilities
- **set_engine** — Set active analysis engines for code scanning
- **export_sarif** — Export findings as SARIF 2.1.0 JSON for GitHub Code Scanning and CI
- **save_baseline** — Save current findings as a baseline for delta scanning
- **scan_with_baseline** — Scan code and report only new findings vs. baseline
- **check_quality_gate** — Evaluate findings against severity thresholds (pass/fail/warn)
- **get_profile** — Get current safety profile configuration
- **set_profile** — Switch safety profile (general, education, healthcare, finance, children)
- **test_pattern** — Test a regex pattern against sample code for custom pattern development
- **audit_log** — Query the security audit log
- **get_findings** — Retrieve past findings with filters
- **shield_status** — Get health, configuration, and OSV cache statistics

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "guardianshield": {
    "command": "uvx",
    "args": ["guardianshield"],
    "env": {
      "GUARDIANSHIELD_PROFILE": "",
      "GUARDIANSHIELD_AUDIT_PATH": "",
      "GUARDIANSHIELD_DEBUG": ""
    }
  }
}
```

**Requires environment variables:** `GUARDIANSHIELD_PROFILE`, `GUARDIANSHIELD_AUDIT_PATH`, `GUARDIANSHIELD_DEBUG` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What GuardianShield MCP server does

GuardianShield MCP server adds security analysis tools to an MCP-compatible client. It can inspect source code for vulnerabilities and embedded credentials, check user or agent input for prompt-injection patterns, and review generated output for PII exposure and content violations. Findings can include CWE identifiers, remediation information, and redacted sensitive values where applicable.

The server also audits dependencies against OSV.dev data for PyPI, npm, Go, and Packagist packages. It recognizes 11 manifest formats, including common files such as `requirements.txt`, `package.json`, `yarn.lock`, `go.mod`, and `composer.json`.

## How it works

GuardianShield MCP server exposes tools through the standard MCP process started by `guardianshield-mcp`. Code scans can target a string, one file, multiple files, a directory, or only added lines from a unified diff. Directory scans support filtering and progress streaming. Dependency scans locate manifests, parse their packages, and compare versions with the local OSV vulnerability database; that database can be synchronized with a separate tool.

Three built-in analysis engines are available: `regex` performs line-oriented pattern matching, `deep` follows tainted data across lines, and `semantic` adjusts confidence using code structure. Results can be stored in the SQLite audit log, retrieved with filters, compared with a saved baseline, or evaluated against severity thresholds.

## Setup and configuration

Install the Python package with:

```bash
pip install guardianshield
```

Start the MCP process directly with:

```bash
guardianshield-mcp
```

Claude Code can register it with `claude mcp add guardianshield -- guardianshield-mcp`. Claude Desktop, Cursor, and VS Code can use the same executable in their MCP configuration; VS Code uses `.vscode/mcp.json`, while Cursor uses `.cursor/mcp.json`.

Configuration is controlled by `GUARDIANSHIELD_PROFILE`, `GUARDIANSHIELD_AUDIT_PATH`, and `GUARDIANSHIELD_DEBUG`. The default profile is `general`, the audit database is stored at `~/.guardianshield/audit.db`, and debug logging is off unless the debug variable is set to `1`.

## Tools and capabilities

The GuardianShield MCP server includes tools for:

- Scanning code, files, directories, file collections, and diffs.
- Detecting secrets, credentials, prompt injection, PII, and content violations.
- Checking packages, parsing manifests, and updating OSV data.
- Managing false-positive records by fingerprint.
- Selecting analysis engines and switching among five safety profiles: general, education, healthcare, finance, and children.
- Exporting SARIF 2.1.0, saving baselines, scanning for new findings, and applying quality gates.
- Testing custom regular expressions, querying audit records, retrieving findings, and checking service status.

## Limitations and notes

Dependency vulnerability checks cover the ecosystems listed in the README: PyPI, npm, Go, and Packagist. Results depend on the local OSV database, which must be synchronized when an updated vulnerability dataset is needed.

The project describes itself as zero-dependency and open source, but this does not remove the need to configure filesystem access, audit storage, or the MCP client. Safety profiles change the active configuration; review the selected profile before relying on findings for a particular domain.

_Full upstream README: https://allmcps.com/mcp/guardianshield/readme_