Log inSubmit server
GuardianShield logo

GuardianShield

Scans code, dependencies, inputs, and outputs for vulnerabilities, secrets, PII, prompt injection, and policy violations.

InstallRepository
Full README Compare alternatives Embed widget Claim this listing

Install GuardianShield

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "guardianshield": {
      "command": "uvx",
      "args": [
        "guardianshield"
      ],
      "env": {
        "GUARDIANSHIELD_PROFILE": "YOUR_VALUE_HERE",
        "GUARDIANSHIELD_AUDIT_PATH": "YOUR_VALUE_HERE",
        "GUARDIANSHIELD_DEBUG": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

uvx guardianshield

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 11d ago.

Overview

GuardianShield MCP server provides local security analysis for source code, dependencies, agent inputs, and AI outputs. It exposes MCP tools for vulnerability scanning, secret and PII detection, prompt-injection checks, OSV.dev dependency audits, baselines, SARIF export, and audit history. Run it when an agent workflow needs security checks during development, CI preparation, or content handling. The server runs through the `guardianshield-mcp` command and supports configurable profiles, engines, and SQLite audit storage.

Use cases

  • Scan changed lines before reviewing a pull request
  • Check dependencies for known OSV vulnerabilities
  • Detect secrets in source files and directories
  • Inspect agent input for prompt injection
  • Export findings for GitHub Code Scanning

Key features

  • Code and secret scanning
  • Prompt-injection and PII detection
  • OSV.dev dependency auditing
  • SARIF export and baseline comparison
  • Configurable safety profiles and engines
  • SQLite audit history

Tools27

What GuardianShield lets your agent do. Expand a tool for its parameters.

Self-reported~450 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

8/8 checks healthy over the last 50d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · guardianshield (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars3Stargazers on the source repository.
Last commit8mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed27Callable tools this server registers over MCP.

How GuardianShield works

What GuardianShield MCP server does

GuardianShield MCP server adds security analysis tools to an MCP-compatible client. It can inspect source code for vulnerabilities and embedded credentials, check user or agent input for prompt-injection patterns, and review generated output for PII exposure and content violations. Findings can include CWE identifiers, remediation information, and redacted sensitive values where applicable.

The server also audits dependencies against OSV.dev data for PyPI, npm, Go, and Packagist packages. It recognizes 11 manifest formats, including common files such as requirements.txt, package.json, yarn.lock, go.mod, and composer.json.

How it works

GuardianShield MCP server exposes tools through the standard MCP process started by guardianshield-mcp. Code scans can target a string, one file, multiple files, a directory, or only added lines from a unified diff. Directory scans support filtering and progress streaming. Dependency scans locate manifests, parse their packages, and compare versions with the local OSV vulnerability database; that database can be synchronized with a separate tool.

Three built-in analysis engines are available: regex performs line-oriented pattern matching, deep follows tainted data across lines, and semantic adjusts confidence using code structure. Results can be stored in the SQLite audit log, retrieved with filters, compared with a saved baseline, or evaluated against severity thresholds.

Setup and configuration

Install the Python package with:

Terminal
pip install guardianshield

Start the MCP process directly with:

bash
guardianshield-mcp

Claude Code can register it with claude mcp add guardianshield -- guardianshield-mcp. Claude Desktop, Cursor, and VS Code can use the same executable in their MCP configuration; VS Code uses .vscode/mcp.json, while Cursor uses .cursor/mcp.json.

Configuration is controlled by GUARDIANSHIELD_PROFILE, GUARDIANSHIELD_AUDIT_PATH, and GUARDIANSHIELD_DEBUG. The default profile is general, the audit database is stored at ~/.guardianshield/audit.db, and debug logging is off unless the debug variable is set to 1.

Tools and capabilities

The GuardianShield MCP server includes tools for:

  • Scanning code, files, directories, file collections, and diffs.
  • Detecting secrets, credentials, prompt injection, PII, and content violations.
  • Checking packages, parsing manifests, and updating OSV data.
  • Managing false-positive records by fingerprint.
  • Selecting analysis engines and switching among five safety profiles: general, education, healthcare, finance, and children.
  • Exporting SARIF 2.1.0, saving baselines, scanning for new findings, and applying quality gates.
  • Testing custom regular expressions, querying audit records, retrieving findings, and checking service status.

Limitations and notes

Dependency vulnerability checks cover the ecosystems listed in the README: PyPI, npm, Go, and Packagist. Results depend on the local OSV database, which must be synchronized when an updated vulnerability dataset is needed.

The project describes itself as zero-dependency and open source, but this does not remove the need to configure filesystem access, audit storage, or the MCP client. Safety profiles change the active configuration; review the selected profile before relying on findings for a particular domain.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about GuardianShield

GuardianShield is an MCP server that connects AI clients to code, dependency, input, and output security checks. Its main tools scan source files, detect secrets and PII, identify prompt injection, check packages against OSV.dev, export SARIF, manage baselines, and query audit findings for developer and CI workflows.

Install it with `pip install guardianshield`, then run `guardianshield-mcp`. Claude Code can register the command with `claude mcp add guardianshield -- guardianshield-mcp`; VS Code, Cursor, and Claude Desktop use MCP configuration entries that invoke the same executable.

Yes, GuardianShield works with Cursor through its MCP configuration. Add a `guardianshield` server entry in `.cursor/mcp.json` and set its command to `guardianshield-mcp`.

Yes, GuardianShield checks dependencies against OSV.dev data for PyPI, npm, Go, and Packagist. It can parse supported manifest formats, scan a directory for manifests, check package versions, and synchronize its local vulnerability database.

Yes, it can export findings as SARIF 2.1.0 for GitHub Code Scanning and CI workflows. Baselines, delta scans, and severity-based quality gates are also available through MCP tools.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewGuardianShield AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/guardianshield?style=directory)](https://allmcps.com/mcp/guardianshield)
HTML Embed
<a href="https://allmcps.com/mcp/guardianshield"><img src="https://allmcps.com/api/badge/guardianshield?style=directory" alt="GuardianShield on AllMCPs" /></a>