# MCP Safety Warden [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/gautamvarmadatla/mcpsafetywarden  
**GitHub Stars:** 8  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcp-safety-warden

## Description
MCP proxy adding security scanning, behavioral profiling, risk gating, and safe tool call execution.

## Tools
Capabilities this server exposes over MCP:

- **onboard_server** — Register + inspect + security scan in one call
- **register_server** — Register a server; optionally auto-inspect
- **inspect_server** — Refresh tool list and profiles
- **check_server_drift** — Detect schema and tool-list drift against stored baseline
- **list_servers** — List all registered servers
- **list_server_tools** — List tools on a server with summary profiles
- **preflight_tool_call** — Risk assessment without execution
- **safe_tool_call** — Execute with risk gating and alternatives
- **get_tool_profile** — Full behavior profile with observed stats
- **get_retry_policy** — Retry and timeout recommendations
- **suggest_safer_alternative** — LLM-ranked safer substitutes
- **run_replay_test** — Idempotency test (calls tool twice)
- **security_scan_server** — Live security audit (mcpsafety+, Cisco, Snyk)
- **scan_all_servers** — mcpsafety+ pipeline across all registered servers
- **get_security_scan** — Latest stored scan report
- **set_tool_policy** — Permanent allow/block policy for a tool
- **get_audit_log** — Audit trail of state-changing calls (who, what, outcome)
- **get_run_history** — Recent execution history for a tool
- **ping_server** — Reachability check with latency
- **discover_servers** — Scan filesystem for MCP client configs and extract server entries
- **onboard_discovered_servers** — Batch-register servers found by `discover_servers
- **get_risk_graph** — Build or query the inventory risk graph (servers, tools, findings, agent clients)
- **explain_tool_risk** — Walk risk paths for a tool: blast radius, composition risks, MITRE tags, recommended action
- **explain_client_risk** — Analyze cross-server risks for all servers under one agent client
- **analyze_cve_blast_radius** — Report CVEs affecting multiple servers under the same client
- **export_graph** — Export risk graph as JSON or Mermaid diagram

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "mcp-safety-warden": {
    "command": "uvx",
    "args": ["mcpsafetywarden"]
  }
}
```

## Documentation

## What MCP Safety Warden does

MCP Safety Warden places a security and execution layer in front of MCP servers. It can register servers, inspect their available tools, maintain behavior profiles, and expose those tools through a guarded proxy. It also supports audit-only workflows for servers that should be examined without making tool calls.

The security model covers tool metadata, call arguments, responses, source code, and relationships between tools. Checks include prompt injection, obfuscated instructions, credential exposure, command and query injection, SSRF, path traversal, unsafe deserialization, suspicious dependencies, and other attack patterns. Responses containing exposed secrets are redacted before storage; responses flagged for injection are quarantined under a run ID instead of being returned to the calling agent.

## How it works

A server can be onboarded, registered, or discovered from MCP client configuration files. Inspection records its tools and creates summary profiles. Subsequent calls can pass through argument checks, drift detection, risk assessment, policy decisions, execution, and response scanning. Observed latency, failure rate, and output size are updated after proxied calls.

The server stores a baseline for tool lists, schemas, and source hashes. Drift checks can run independently or during calls, allowing changes such as removed tools, altered schemas, or modified source to be identified. Behavioral classification covers effect class, destructiveness, retry safety, and risk tags including credential exposure, arbitrary execution, filesystem access, lateral movement, privilege escalation, data exfiltration, and prompt-injection surface.

Security audits can use the mcpsafety+ five-stage pipeline and may incorporate Cisco AI Defense, Snyk, Kali, and Burp Suite integrations. GitHub source analysis includes secret detection, AST taint tracking, description-to-implementation comparison, Bandit, Semgrep, and LLM-assisted review for Python and TypeScript/JavaScript projects.

## Setup and configuration

Install the package with Python 3.10 or later:

```bash
pip install mcpsafetywarden
```

Use `pip install "mcpsafetywarden[all]"` for all optional extras, or select extras such as `anthropic` and `snyk`. Installation from the Git repository is also supported. The SQLite database is created automatically in the platform user data directory on first run.

At least one wrapped MCP server is needed for proxy operation. Wrapped servers may use stdio, SSE, or streamable HTTP. Anthropic, OpenAI, or Gemini credentials are recommended for LLM-assisted classification and scanning. Without an LLM key, operation falls back to rule-based classification and regex injection checks, with no alternatives in the risk gate or mcpsafety+ pipeline. Ollama can provide a local option when `OLLAMA_MODEL` is set and the Ollama provider is selected explicitly.

## Tools and capabilities

- Register, inspect, enumerate, and ping MCP servers and their tools.
- Run preflight risk checks or execute calls through risk gating.
- Apply permanent per-tool allow or block policies.
- Recommend safer substitutes and retry or timeout settings.
- Run replay tests to examine tool idempotency.
- Perform individual or batch security scans and retrieve stored reports.
- Inspect audit logs and recent execution history.
- Discover servers from local MCP client configurations and onboard them in batches.
- Build, query, and export a risk graph as JSON or Mermaid, including tool blast radius, composition paths, client exposure, MITRE tags, and shared CVE impact.

The CLI provides 24 subcommands, an interactive risk menu, JSON output through `--json`, and a `--yes` option for CI use.

## Limitations and notes

Stdio servers that require local configuration before startup—such as credentials, data directories, configuration files, or operating-system dependencies—cannot be inspected successfully by the wrapper when those requirements are absent. A source scan can still run against a GitHub repository by supplying its URL, without spawning the server.

Without an LLM provider, classification confidence is lower and the available scanning and risk-gating behavior is reduced. Kali-based network checks require a registered Kali Linux MCP server, while HTTP probing and blind SSRF checks require a registered Burp Suite MCP server.

_Full upstream README: https://allmcps.com/mcp/mcp-safety-warden/readme_