MCP Security Guard

What MCP Security Guard does

The MCP Security Guard MCP server examines MCP servers installed or configured on a developer’s machine. It checks more than tool names and descriptions: server instructions, prompts, resources, resource templates, parameter schemas, launch commands, packages, containers, and related agent context are included in the audit.

The scanner looks for instruction overrides, secret-reading directives, conversation harvesting, exfiltration paths, encoded payloads, invisible Unicode characters, ANSI escapes, homoglyph names, tool shadowing, and collisions between tools. It also detects changes to pinned tool definitions and launch commands, along with changes to plugin and repository files such as skills, commands, subagents, rules, hooks, and CLAUDE.md.

Risk reporting includes per-tool capability classification for execution, deletion, writing, and egress; a 0–100 score; an A–F grade; recommended permission rules; and OWASP MCP Top 10 identifiers. Supply-chain checks cover OSV vulnerabilities, malicious versions, typosquats, new or missing packages, install scripts, publisher changes, and unpinned package, image, or Git sources.

How it works

MCP Security Guard MCP server discovers configurations across Claude Code and Claude Desktop scopes, installed plugins, Claude Desktop extensions, managed configuration, other supported clients, and previously used claude.ai connectors. It labels servers shipped inside plugins as <plugin>:<server> and scans the available configuration and metadata locally.

Runtime hooks can ask for approval before credentials are sent to an MCP server and warn when outputs contain injected instructions or credentials. The server also maintains a content-free local audit log for MCP calls. Toxic-flow analysis identifies combinations of untrusted input, private data, and outbound data transmission, treating the result as a posture note rather than a defect.

The project reports coverage for 26 of 27 documented tool-poisoning techniques, with stated testing against benign samples and real servers. Detection patterns for runtime output are described as English-based.

Setup and configuration

The simplest test requires Node.js 20 or newer. Clone the repository and run node scripts/offline-demo.mjs; this compares saved tool descriptions without installing dependencies, launching an MCP server, or using an account or API key.

For Claude Code, install the plugin with /plugin marketplace add petrovicistefan/mcp-security-guard and /plugin install mcp-security-guard@mcp-security-guard, then run /mcp-audit. Other clients can launch the npm package through a standard stdio configuration using npx -y mcp-security-guard. The equivalent command-line audit is npx mcp-security-guard audit --project-only.

A .mcp-security.json file can define approved and blocked servers and hosts. The optional team plan uses MCP_SECURITY_API_KEY for central policy and other organisation features. Fleet reporting additionally requires MCP_SECURITY_TEAM_REPORT=on; reports are opt-in and can be previewed with team report --dry-run.

Limitations and notes

The MCP Security Guard MCP server operates locally by default, and its local checks do not provide organisation-wide discovery or aggregated audit data. OAuth scope review is listed as planned for a hosted Team plan. Team functionality is paid and opt-in, with keys issued manually.

The tool can identify configuration and capability risks, but its documented runtime detection patterns are English-based. Claude.ai connectors are discovered by name only because their configuration remains in the account. The repository’s results describe measured detection coverage, not a guarantee that every attack or unsafe server will be identified.