Log inSubmit server
Zn Gate logo

Zn Gate

Local MCP security layer that checks prompt injection, redacts secrets, and audits agent access to tools and content.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Zn Gate

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "zn-gate": {
      "command": "npx",
      "args": [
        "-y",
        "zn-gate"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

zn-gate runs locally between coding agents and the tools or content they access. It checks prompts, tool calls, and returned content for prompt injection, while redacting or blocking exposed secrets and protecting credential files. It supports Claude Code, Codex CLI, Cursor, OpenCode, and MCP clients through hooks, a Claude Code plugin, or an MCP-only mode. Reach for it when an agent needs access to local files, MCP servers, or development secrets without exposing those values to its model.

Use cases

  • Protect Claude Code sessions from secret exposure
  • Check MCP and tool content for prompt injection
  • Move .env values into a local encrypted vault
  • Add redaction and policy checks to LangChain tools
  • Audit which local resources coding agents can reach

Key features

  • Prompt-injection checks
  • Secret redaction and blocking
  • Local vault for environment values
  • Hooks for Codex CLI, Cursor, and OpenCode
  • Claude Code plugin
  • MCP server mode

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

4/4 checks healthy over the last 12d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 8d ago via OSV.dev · zn-gate (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars2Stargazers on the source repository.
npm downloads3.6kPackage downloads in the last 30 days.
Last commitTodayMost recent push to the default branch.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Zn Gate works

What zn-gate does

zn-gate adds local security checks around coding agents and agent-built applications. It identifies secrets in environment files, credential files, and tool output; keeps real values out of model-visible content; and checks prompts, files, tool calls, and other untrusted text for prompt injection. It also audits prompts, skills, and configuration files.

The project provides several operating modes. Its hooks protect Codex CLI, Cursor, and OpenCode, while a plugin is available for Claude Code. It can also run as an MCP server that an agent calls explicitly. For applications built with LangChain, CrewAI, LlamaIndex, or direct tool-calling code, the Python package supplies the rules engine and secret-redaction features.

How it works

All processing runs on the local machine and requires no account or API key. The reach command performs a read-only inventory of locally detectable secrets, credential files, and MCP servers. init finds supported coding agents, presents the changes it would make, asks for confirmation at each step, and finishes by running a protection check.

Secret values can be moved from a .env file into zn-gate's local vault with env shadow. The original file retains markers such as __ZN_STRIPE_KEY__, and the run command can start an application after the relevant access is allowed. The check command uses a fake secret in a temporary directory to verify that protection is active.

In MCP-only mode, the agent decides when to call zn-gate, so this mode is not automatic protection. The Claude Code plugin and hooks provide the agent-specific interception described for their supported environments.

Setup and configuration

Node.js 18 or newer is required for the main commands. The Claude Code plugin requires Node.js 20.12 or newer, Git, and Claude Code 2.1.295 or newer. Install the npm package globally for hooks, or launch it directly with npx:

Terminal
npx -y zn-gate reach
npx -y zn-gate init
npx -y zn-gate check

Create the vault before shadowing environment values:

Terminal
npx -y zn-gate unlock
npx -y zn-gate env shadow .env

For MCP-only use, register npx -y zn-gate mcp with the client. Claude Code can add it with claude mcp add, and Codex CLI with codex mcp add. Cursor and other editors use their MCP configuration files.

The Python package is intended for agents you build yourself and should be installed in a virtual environment. It has no runtime dependencies.

Tools and capabilities

  • Inspect locally reachable secrets, credential files, and MCP servers with reach.
  • Install or revert agent protection with init and init --revert.
  • Validate protection using check.
  • Store environment values in the local vault with unlock and env shadow.
  • Run applications that resolve vault markers with run.
  • Expose zn-gate as an MCP server through the mcp command.
  • Add Python checks to LangChain and LangGraph with ZnGuardCallbackHandler and guard_langchain_tool.

Limitations and notes

The MCP-only mode depends on the agent choosing to call the server and therefore does not automatically intercept all activity. Cursor's hook setup does not scrub shell output or file contents. The Claude Code protection described here does not cover Claude Code cloud sessions, Cowork, or chat.

When using the Python callback, a tool output containing a secret can stop the run because the callback cannot alter the returned value. Wrapping the tool allows output masking while continuing, when configured as described by the package. On Windows PowerShell, npm.cmd, npx.cmd, and zn.cmd may be needed if script execution is disabled.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Zn Gate

zn-gate is an MCP server that connects coding agents and MCP clients to local security checks. Its main tools and commands inspect reachable secrets and MCP servers, check prompt-injection risks, redact secret values, audit agent content, and manage protected environment values through a local vault.

Run `npx -y zn-gate mcp` directly or register that command with your MCP client. Claude Code uses `claude mcp add zn-gate -- npx -y zn-gate mcp`, while Codex CLI uses the equivalent `codex mcp add` command.

Yes, zn-gate supports Cursor through hooks or as an MCP server. Install the hooks with `npm install -g zn-gate` followed by `zn hooks install cursor`; for MCP-only use, add `npx -y zn-gate mcp` to Cursor's MCP configuration.

zn-gate requires Node.js 18 or newer. Its Claude Code plugin requires Node.js 20.12 or newer, while older supported Node.js versions can use zn's Claude Code hooks instead of the plugin.

Yes, the Python package provides LangChain and LangGraph integrations. `ZnGuardCallbackHandler` can stop runs for blocked prompts, tool calls, or outputs, and `guard_langchain_tool` checks tool arguments before execution while checking and masking returned output.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewZn Gate AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/zn-gate?style=directory)](https://allmcps.com/mcp/zn-gate)
HTML Embed
<a href="https://allmcps.com/mcp/zn-gate"><img src="https://allmcps.com/api/badge/zn-gate?style=directory" alt="Zn Gate on AllMCPs" /></a>