io.github.petrovicistefan/mcp-security-guard

What it mainly works on, as our AI model read its tool descriptions: files and code on the machine it runs on.

10 of 17 tools are described as changing something (creating, editing, deleting, sending or running).

• list_mcp_serverson 11 other serversreads or searches

  “Lists every MCP server configured for this project (user, local and project scope in Claude Code, plus Claude Desktop) with its transport.”

  Publisher declares: read-only yes · open-world no

  1 input

  • project_dirstring“Project directory.”
• audit_mcp_configon 6 other serversreads or searches

  “Static audit of MCP server configuration: plaintext secrets in env/headers/args/URLs, plain-HTTP remote servers, unpinned npx/uvx packages, unpinned or privileged Docker containers, pipe-to-shell lau…”

  Publisher declares: read-only yes · open-world no

  1 input

  • project_dirstring“Project directory.”
• audit_agent_contexton 1 other serverreads or searches

  “Scans the text files Claude reads besides MCP tools: CLAUDE.md, skills (and their bundled scripts), slash commands, subagents, rules and the hook configs of installed plugins, from the user, the proj…”

  Publisher declares: read-only yes · open-world no

  2 inputs

  • project_onlyboolean“Only the project's own files (CLAUDE.md, .claude/).”
  • project_dirstring“Project directory.”
• pin_contextcreates or changes datadescribed as changing data

  “Records a SHA-256 of every skill, command, subagent, rule, CLAUDE.md, plugin hook config and bundled script (user, project and each installed plugin) in ~/.claude/mcp-security/context-pins.json, so l…”

  Publisher declares: read-only no · destructive no · idempotent yes · open-world no

  3 inputs

  • originsarray“Only these origins: "user", "project", "plugin:<name>".”
  • forceboolean“Pin origins that still have critical or high findings.”
  • project_dirstring
• audit_server_toolsreads or searchesdescribed as changing data

  “Connects to the selected MCP servers, lists their tools, and checks every name, description and schema string for tool poisoning (instruction overrides, concealment requests, hidden tags, invisible U…”

  Publisher declares: read-only yes · open-world yes

  4 inputs, 2 required

  • serversarrayrequired“Server names to scan, optionally as "scope:name" (e.g.”
  • confirm_launchbooleanrequired“Must be true.”
  • timeout_secondsinteger
  • project_dirstring
• pin_toolscreates or changes datadescribed as changing data

  “Records a SHA-256 hash of every tool definition of the selected servers in ~/.claude/mcp-security/pins.json, so later audits can detect rug pulls.”

  Publisher declares: read-only no · destructive no · idempotent yes · open-world yes

  4 inputs, 2 required

  • serversarrayrequired“Server names to scan, optionally as "scope:name" (e.g.”
  • confirm_launchbooleanrequired“Must be true.”
  • timeout_secondsinteger
  • project_dirstring
• analyze_tool_definitionscalculates or converts

  “Runs the tool-poisoning checks on tool definitions you pass in (e.g.”

  Publisher declares: read-only yes · open-world no

  2 inputs, 2 required

  • server_namestringrequired“Label used in the report.”
  • toolsarrayrequired
• check_supply_chainreads or searchesdescribed as changing data

  “For servers launched with npx/uvx and similar, checks the package on its registry and in the OSV database: known vulnerabilities, known malicious versions, typosquats of popular MCP packages, non-exi…”

  Publisher declares: read-only yes · open-world yes

  4 inputs, 1 required

  • serversarray“Server names, or ["*"] for all.”
  • confirm_networkbooleanrequired“Must be true: package names and versions are sent to the registries and OSV.”
  • scan_imagesboolean“Also scan container images of Docker-based servers with Trivy or Grype if installed (may pull images and the scanner database).”
  • project_dirstring
• adversarial_testruns code or commandsdescribed as changing data

  “CALLS every non-destructive tool of one configured server with command-injection payloads (each would only create an empty canary file) and path-traversal payloads, then reports which parameters reac…”

  Publisher declares: read-only no · destructive no · open-world yes

  7 inputs, 3 required

  • serverstringrequired“Server name, optionally "scope:name".”
  • i_own_this_serverbooleanrequired“Must be true: the user confirmed they own or operate this server.”
  • confirm_launchbooleanrequired“Must be true: the user agreed that the server is started and its tools are called.”
  • include_destructiveboolean
  • canary_dirstring“Writable directory as seen by the server (default: the OS temp directory).”
  • host_canary_dirstring
  • project_dirstring
• security_dashboardon 1 other serverreads or searchesdescribed as changing data

  “Opens the interactive mcp-security-guard dashboard: every configured MCP server with its score and grade, findings filterable by severity and server, the OWASP MCP Top 10 breakdown, recommended permi…”

  Publisher declares: read-only yes · open-world yes

  3 inputs

  • scanstring
  • confirm_launchboolean
  • project_dirstring
• apply_fixeson 3 other serverscreates or changes datadescribed as changing data

  “Fixes findings in the project's own files.”

  Publisher declares: read-only no · destructive no · idempotent yes · open-world yes

  6 inputs, 1 required

  • fixesarrayrequired
  • writeboolean“false = dry run.”
  • serversarray“Servers considered for the permissions fix.”
  • confirm_launchboolean
  • confirm_networkboolean
  • project_dirstring
• generate_policyon 1 other servergenerates content

  “Returns a .mcp-security.json policy that approves exactly the MCP servers configured now (and their remote hosts) and requires pinned versions.”

  Publisher declares: read-only yes · open-world no

  1 input

  • project_dirstring

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-23.

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.