# zn-gate [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/usezn/zn  
**GitHub Stars:** 2  
**npm Downloads (last month):** 3587  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/zn-gate

## Description
Local security layer for coding agents: prompt-injection checks, secret redaction, MCP proxy.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "zn-gate": {
    "command": "npx",
    "args": ["-y","zn-gate"]
  }
}
```

## Documentation

## What zn-gate does

zn-gate adds local security checks around coding agents and agent-built applications. It identifies secrets in environment files, credential files, and tool output; keeps real values out of model-visible content; and checks prompts, files, tool calls, and other untrusted text for prompt injection. It also audits prompts, skills, and configuration files.

The project provides several operating modes. Its hooks protect Codex CLI, Cursor, and OpenCode, while a plugin is available for Claude Code. It can also run as an MCP server that an agent calls explicitly. For applications built with LangChain, CrewAI, LlamaIndex, or direct tool-calling code, the Python package supplies the rules engine and secret-redaction features.

## How it works

All processing runs on the local machine and requires no account or API key. The `reach` command performs a read-only inventory of locally detectable secrets, credential files, and MCP servers. `init` finds supported coding agents, presents the changes it would make, asks for confirmation at each step, and finishes by running a protection check.

Secret values can be moved from a `.env` file into zn-gate's local vault with `env shadow`. The original file retains markers such as `__ZN_STRIPE_KEY__`, and the `run` command can start an application after the relevant access is allowed. The `check` command uses a fake secret in a temporary directory to verify that protection is active.

In MCP-only mode, the agent decides when to call zn-gate, so this mode is not automatic protection. The Claude Code plugin and hooks provide the agent-specific interception described for their supported environments.

## Setup and configuration

Node.js 18 or newer is required for the main commands. The Claude Code plugin requires Node.js 20.12 or newer, Git, and Claude Code 2.1.295 or newer. Install the npm package globally for hooks, or launch it directly with `npx`:

```bash
npx -y zn-gate reach
npx -y zn-gate init
npx -y zn-gate check
```

Create the vault before shadowing environment values:

```bash
npx -y zn-gate unlock
npx -y zn-gate env shadow .env
```

For MCP-only use, register `npx -y zn-gate mcp` with the client. Claude Code can add it with `claude mcp add`, and Codex CLI with `codex mcp add`. Cursor and other editors use their MCP configuration files.

The Python package is intended for agents you build yourself and should be installed in a virtual environment. It has no runtime dependencies.

## Tools and capabilities

- Inspect locally reachable secrets, credential files, and MCP servers with `reach`.
- Install or revert agent protection with `init` and `init --revert`.
- Validate protection using `check`.
- Store environment values in the local vault with `unlock` and `env shadow`.
- Run applications that resolve vault markers with `run`.
- Expose zn-gate as an MCP server through the `mcp` command.
- Add Python checks to LangChain and LangGraph with `ZnGuardCallbackHandler` and `guard_langchain_tool`.

## Limitations and notes

The MCP-only mode depends on the agent choosing to call the server and therefore does not automatically intercept all activity. Cursor's hook setup does not scrub shell output or file contents. The Claude Code protection described here does not cover Claude Code cloud sessions, Cowork, or chat.

When using the Python callback, a tool output containing a secret can stop the run because the callback cannot alter the returned value. Wrapping the tool allows output masking while continuing, when configured as described by the package. On Windows PowerShell, `npm.cmd`, `npx.cmd`, and `zn.cmd` may be needed if script execution is disabled.

_Full upstream README: https://allmcps.com/mcp/zn-gate/readme_