Log inSubmit server
MCP Safety Warden logo

MCP Safety Warden

Proxy and audit layer for MCP servers with profiling, security scans, risk gating, drift detection, and controlled tool execution.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP Safety Warden

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "mcp-safety-warden": {
      "command": "uvx",
      "args": [
        "mcpsafetywarden"
      ],
      "env": {
        "OLLAMA_MODEL": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

uvx mcpsafetywarden

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 13d ago.

Overview

MCP Safety Warden MCP server wraps MCP servers to add behavioral profiling, security scanning, risk assessment, drift detection, and gated execution. It can proxy stdio, SSE, and streamable HTTP servers, or audit a server's source from GitHub without invoking its tools. Reach for it when you need to inventory MCP servers, inspect tool behavior, block risky calls, or investigate cross-server exposure. LLM providers improve classification and scanning, while rule-based checks remain available without an API key.

Use cases

  • Register and inventory MCP servers discovered in client configuration files
  • Preflight tool calls before forwarding them to a wrapped server
  • Scan GitHub-hosted MCP source code without executing its tools
  • Detect schema, tool-list, and source changes after onboarding
  • Explain cross-server risk paths and CVE blast radius

Key features

  • Behavioral profiling with observed execution statistics
  • Argument and output injection scanning
  • Risk-gated execution with per-tool policies
  • Server, schema, and source drift detection
  • Multi-stage security audits and stored reports
  • Risk graph analysis with JSON and Mermaid export

Tools25

What MCP Safety Warden lets your agent do. Expand a tool for its parameters.

Self-reported~385 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

10/10 checks healthy over the last 57d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 16d ago via OSV.dev · mcpsafetywarden (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars8Stargazers on the source repository.
Last commit5d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed25Callable tools this server registers over MCP.

How MCP Safety Warden works

What MCP Safety Warden MCP server does

MCP Safety Warden MCP server operates in two modes: it can sit between an agent and a wrapped MCP server, or it can perform an audit without forwarding a tool call. The proxy records tool metadata and observed behavior, assesses calls before execution, scans arguments and outputs, and applies configured risk decisions.

It maintains an inventory of registered servers, their tools, behavior profiles, scan results, execution history, and relationships in a risk graph. Profiles can include effect class, destructiveness, retry safety, latency percentiles, failure rate, output size, and risk tags such as credential exposure, arbitrary execution, filesystem access, or prompt injection surface.

How it works

Registration can inspect a server immediately, while inspection refreshes its tool list and profiles. The system stores baselines for detecting schema, tool-list, and source changes. Drift checks can run independently or as part of proxied calls.

Before a call is forwarded, argument checks look for categories including SSRF, path traversal, credential-file access, command injection, injection payloads, deserialization attacks, and obfuscated variants. Output checks scan for prompt injection and redact exposed credentials. Responses flagged as injection risks are quarantined rather than returned to the calling agent.

The security pipeline can combine mcpsafety+, Cisco AI Defense, Snyk, and optional Kali Linux or Burp Suite MCP data. Source analysis can retrieve GitHub code and examine secrets, taint flows, description-to-implementation mismatches, Bandit, Semgrep, and related signals for Python and TypeScript/JavaScript projects.

Setup and configuration

Install the package with pip install mcpsafetywarden. The project also provides an all extra and named extras such as anthropic and snyk; it can alternatively be installed from a cloned source tree. Python 3.10 or newer is required, along with at least one wrapped MCP server using stdio, SSE, or streamable HTTP. A SQLite database is created automatically in the platform user data directory on first run.

An Anthropic, OpenAI, or Gemini API key is recommended for LLM-assisted classification and scanning. Without a key, rule-based mode provides lower-confidence classification, regex-only injection scanning, no risk-gate alternatives, and no mcpsafety+ pipeline. Ollama can provide a local option when OLLAMA_MODEL is set and the provider is explicitly selected.

Tools and capabilities

MCP Safety Warden MCP server exposes tools for:

  • Registering, inspecting, listing, pinging, and discovering servers.
  • Checking drift and retrieving server or tool profiles.
  • Preflighting calls, executing them with risk gates, and suggesting safer alternatives.
  • Setting permanent per-tool allow or block policies.
  • Running replay tests, retrieving retry guidance, and reviewing execution history.
  • Running individual or fleet-wide security scans and retrieving stored reports.
  • Building risk graphs, explaining tool or client risk, analyzing CVE blast radius, and exporting JSON or Mermaid diagrams.

The replay test calls a tool twice to examine idempotency. Risk analysis also covers composition patterns across tools and servers, including read-write combinations, write-then-execute sequences, and data accumulation followed by exfiltration.

Limitations and notes

Servers that require local configuration before startup may fail inspection if configuration files, credentials, data directories, or operating-system dependencies are missing. In that case, no tools may be stored, although a GitHub source scan can still run when a repository URL is supplied.

LLM-backed features depend on the selected provider and configuration. Local Ollama is not auto-detected. Network and host findings from Kali Linux, and HTTP probing from Burp Suite, require those MCP servers to be registered.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Safety Warden

MCP Safety Warden is an MCP server that wraps stdio, SSE, or streamable HTTP MCP servers and adds behavioral profiling, security scanning, risk gating, drift detection, and safe tool execution. Its main tools register and inspect servers, preflight or execute calls, run audits, manage policies, and explain inventory risk.

Install it with `pip install mcpsafetywarden`. You can install optional dependencies with `pip install "mcpsafetywarden[all]"`, choose named extras, or install from a cloned repository. Python 3.10 or later and at least one wrapped MCP server are required.

No, an LLM API key is not required. Without one, the server uses rule-based classification and regex-only injection scanning, but omits LLM-ranked alternatives and the mcpsafety+ pipeline. Anthropic, OpenAI, or Gemini keys are recommended; Ollama can be used explicitly for local operation.

Yes, if the local stdio server can start with its required configuration, credentials, data directories, and operating-system dependencies. If those prerequisites are missing, discovery can fail and no tools may be stored. A GitHub source scan can still run when a repository URL is provided.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Safety Warden AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/mcp-safety-warden?style=directory)](https://allmcps.com/mcp/mcp-safety-warden)
HTML Embed
<a href="https://allmcps.com/mcp/mcp-safety-warden"><img src="https://allmcps.com/api/badge/mcp-safety-warden?style=directory" alt="MCP Safety Warden on AllMCPs" /></a>