Log inSubmit server
Tripwire Guard — evidence First injection scanner logo

Tripwire Guard — evidence First injection scanner

Local read-only MCP scanner for known prompt-injection patterns with exact evidence and no network.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Tripwire Guard — evidence First injection scanner

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "tripwire-guard-evidence-first-injection-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "tripwire-guard"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 1 tools correctly (6d ago).

Overview

Tools1

What Tripwire Guard — evidence First injection scanner lets your agent do. Expand a tool for its parameters.

Verified live~190 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

8/8 checks healthy over the last 59d

What it can do

From the 1 tool this server returned when we ran it; 1 declare their own safety hints.

Read-only tools · 1
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age65 days
Maintainers1

Observed 2026-10-18 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 4d ago via OSV.dev · tripwire-guard (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads148Package downloads in the last 30 days.
Last commit2mo agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed1Callable tools this server registers over MCP.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

From the project README

Tripwire Guard

Public package: tripwire-guard. A clean install and MCP handshake were verified on 13 August 2026.

A local, read-only MCP server that inspects untrusted text for prompt-injection before it enters an AI agent's context.

Give it text (a web page, document, email, ticket, RAG chunk) and it returns an allow / review / recommend_block decision with the exact matched evidence. It runs entirely on your machine, makes no network requests, and redacts emails, URLs and credential-like strings by default.

The engine is deterministic and ships with a public 100-case maintainer-authored evaluation — 85% accuracy, with every false positive and false negative published. It is a fast, explainable signal layer; it is not a guarantee of safety, and the host remains responsible for enforcing the decision.

Unlike an MCP proxy, Tripwire Guard does not intercept or authorize other tool calls. Unlike a model-based detector, it needs no model runtime or API. Pair it with least-privilege tools, approval gates, isolation and action-sink enforcement.

Install / run

Requires Node.js 22.12+.

Terminal
npx tripwire-guard

Use it in an MCP host

config.json
{
  "mcpServers": {
    "tripwire": {
      "command": "npx",
      "args": ["-y", "tripwire-guard"]
    }
  }
}

The tool

tripwire_scan (read-only) — inputs:

  • content (string, required) — untrusted text to inspect.
  • source (string, optional) — provenance, e.g. a page URL, email, tool result, or document name.
  • includeEvidence (boolean, optional) — return raw matched evidence instead of redacted. Defaults to redacted.

Returns structured evidence: the decision, a finding count, per-finding rule id / severity / category / matched span, and the engine + ruleset versions.

The npm package is versioned independently from the detector engine reported inside each result. Package 0.4.2 currently ships engine 0.3.0 and ruleset 2026.08.2.

Honest limits

Deterministic heuristics can miss novel, contextual, multilingual, visual, or heavily obfuscated attacks. A clean result means "no known signal matched," not "safe." Pair it with least-privilege tools, approval gates, and sandboxing.

Map the surrounding system

Use the free agent action-path worksheet to map an untrusted input, its reachable tools, the consequential action sink, existing controls, and the minimum safe test evidence. It is ungated and contains a clearly labelled synthetic example.

More

Live demo, full benchmark, threat model, and fixed-scope team review: https://tripwire-live.netlify.app

Source and security boundary

This repository contains the distributable MIT-licensed, read-only Guard MCP server and its release metadata. The broader Tripwire browser product and paid review materials are maintained separately. Report package defects through this repository's issue tracker; do not post secrets, customer data, private prompts, or live credentials.

© 2026 Kuba Opoczka.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Tripwire Guard — evidence First injection scanner

Tripwire Guard — evidence-first injection scanner is an MCP server that inspects untrusted text for known prompt-injection patterns before it enters an AI agent’s context. It runs locally, read-only, and without network requests, returning allow, review, or recommend_block decisions with exact matched evidence and default redaction of sensitive strings.

Run `npx tripwire-guard` with Node.js 22.12 or newer. In an MCP host, configure the server with command `npx` and args `["-y", "tripwire-guard"]`.

The `tripwire_scan` tool returns a decision, finding count, and per-finding rule ID, severity, category, and matched span. It also reports engine and ruleset versions. Provide required `content`; optionally provide `source` and set `includeEvidence` to true for raw rather than redacted matched evidence.

Tripwire Guard makes no network requests and runs entirely on the local machine. It is a read-only scanner, not an MCP proxy, so it does not intercept or authorize other tool calls; the host remains responsible for enforcing its decisions.

Tripwire Guard is a deterministic, explainable signal layer rather than a safety guarantee. Its public 100-case maintainer-authored evaluation reports 85% accuracy, while the scanner can miss novel, contextual, multilingual, visual, or heavily obfuscated attacks. Pair it with least-privilege tools, approval gates, isolation, and action-sink enforcement.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewTripwire Guard — evidence First injection scanner AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/tripwire-guard-evidence-first-injection-scanner?style=directory)](https://allmcps.com/mcp/tripwire-guard-evidence-first-injection-scanner)
HTML Embed
<a href="https://allmcps.com/mcp/tripwire-guard-evidence-first-injection-scanner"><img src="https://allmcps.com/api/badge/tripwire-guard-evidence-first-injection-scanner?style=directory" alt="Tripwire Guard — evidence First injection scanner on AllMCPs" /></a>