Aguara MCP

What Aguara MCP does

Aguara MCP adds local security review tools to an MCP-compatible agent. It is intended for checking third-party agent skills, README files, prompts, tool definitions, MCP server descriptions, package metadata, workflow files, and client configuration before the agent trusts or executes them.

The scanner looks for prompt injection, credential exposure, data exfiltration, command execution, supply-chain risks, MCP-specific attacks, package-install payloads, risky GitHub Actions trust chains, unsafe agent configuration, and Unicode or encoding evasion. Sensitive matches are redacted in results so a finding does not reproduce a detected secret.

How it works

The server imports Aguara as a Go library and performs scans inside the MCP process. It does not call an LLM, access the network, or invoke the aguara command-line binary. Results include a clean, flag, or block verdict, severity-rated findings, remediation guidance, line numbers, confidence scores, matched patterns where safe, and the analysis engine responsible for each finding.

scan_content can use a filename hint to select context-specific checks. It supports context-aware handling through tool_name, enforcement profiles, minimum severity thresholds, and caller-selected disabled rules. check_mcp_config accepts an MCP configuration as JSON and checks commands, arguments, environment variables, argument injection, and tool-poisoning patterns before a client enables the configuration.

Setup and configuration

Install the binary with the project’s shell installer. The installer verifies SHA256 checksums and stops if no SHA256 verifier is available. Ensure ~/.local/bin is on PATH, then register aguara-mcp over stdio with the chosen MCP client.

Claude Code can add it with claude mcp add aguara -- aguara-mcp. Claude Desktop uses an mcpServers entry whose command is aguara-mcp; Cursor, Windsurf, and other MCP clients can use the same stdio command. Building from source requires Go 1.26 or later.

Tools and capabilities

• Recognized content includes skills, prompts, READMEs, tool definitions, MCP descriptions, package.json, selected workflow and agent-instruction files, Claude Code settings, and npm or pnpm policy files.
• check_mcp_config: Reviews an MCP server JSON configuration before installation or activation.
• list_rules: Filters the embedded catalog of 259 detections by category.
• explain_rule: Provides details for a rule ID, including remediation and, for YAML rules, patterns and examples.
• discover_mcp: Reads known local client configuration files and returns a redacted inventory with client identifiers, server IDs, and argument or environment counts.

Limitations and notes

The MCP server provides single-content scans rather than repository-wide dependency auditing. Checks for npm, PyPI, pnpm, Go, crates.io, Composer, RubyGems, Maven, and NuGet repositories remain available through the Aguara CLI. Discovery output is a redacted inventory, not scan input or a security verdict; pass the original configuration JSON to check_mcp_config. The embedded engine contains rules and analyzers, but catalog availability does not activate bundle checks or stateful monitoring through these MCP tools.