$49
One-time digital kit for founders who want the audit workflow ready today.
- Policy and baseline templates
- GitHub Action setup checklist
- Audit pack handoff template
- Private repo rollout guide
Secure MCP tools before agents run them.
Local-first scanner for risky shell commands, leaked secrets, env files, broad filesystem access, Docker runtime risk, remote MCP endpoints, plaintext HTTP, and unpinned packages.
Local-first
No config upload
Audit packs
Baseline mode
mcp-guard
Scan completed · 2s
Risk Score
100
Critical
- 4 Critical
- 7 High
- 2 Medium
Top Issues
Critical
Shell injection via bash -c
mcp-servers.json:12
High
Broad filesystem access
args: ["/"]
Critical
Docker socket mounted
/var/run/docker.sock
SARIF
HTML
JSON
{
"ruleId": "MCP010",
"level": "error",
"message": "Shell command executes inline script",
"uri": "mcp-servers.json"
}
MCP basics
Understand the config before an agent uses it.
MCP connects AI clients to tool servers. That connection is powerful because a server can expose file access, shell commands, SaaS APIs, databases, browser tools, containers, or remote endpoints.
The config is the review point. It shows what command starts, which package runs, what paths are mounted, which env files load, and what secrets or headers are passed into the server.
Client
AI app or agent runtime
Claude Desktop, Cursor, Codex, or an internal agent decides which MCP servers are available to the model.
Server
Tool, data, or service bridge
A local process or remote endpoint exposes tools, resources, or prompts that the agent can call.
Config
Commands, URLs, args, env, envFile, headers
This is where shell wrappers, unpinned packages, broad filesystem paths, Docker socket mounts, plaintext HTTP, and credentials usually enter.
Guardrail
Review before merge or local install
Scan the config before the agent runs it, then commit policy and baseline files for repeatable team review.
Find the configs teams actually use.
Run from a repo root or a nested package. mcp-guard checks project, parent, editor, and user-level MCP configuration without uploading local paths or secrets.
Project tree
Repo and parent discovery
Checks `.mcp.json`, `mcp.json`, `.cursor/mcp.json`, and `.vscode/mcp.json` from the current directory upward.
Editor profiles
Cursor, VS Code, Claude Desktop
Scans common user-level config paths so local agent setup is visible before it becomes team risk.
Secret flow
Env vars, env files, headers
Redacts secret-like values while still showing where credentials enter MCP server runtime.
Remote trust
URLs, HTTP, approved endpoints
Flags remote MCP servers, plaintext HTTP endpoints, high-risk container flags, and policy violations against approved URLs.
Scan locally with the CLI
Fast, private, and simple enough for local review or pre-commit workflows.
npm i -g agent-mcp-guard
mcp-guard init
mcp-guard rules --format markdown
mcp-guard policy --config .mcp.json --dry-run
mcp-guard scan --policy .mcp-guard-policy.json --format html- Bootstrap a GitHub Action in one command
- Inspect the rule catalog from the CLI
- Discover project, parent, Cursor, VS Code, and Claude configs
- Generate conservative policy drafts for review
- Detect risky shell commands, env files, Docker socket mounts, plaintext HTTP, and broad access
- Enforce approved commands, packages, directories, and URLs
- Redact secret-like env vars and headers
- Output text, Markdown, HTML, JSON, and SARIF
Automate with GitHub Action
Block risky MCP config changes before they merge, with reports attached to the run.
- uses: ChaoYue0307/mcp-guard-action@v0.4.11
with:
config: .mcp.json
# policy: .mcp-guard-policy.json
baseline: .mcp-guard-baseline.json
fail-on: high
comment-pr: "true"
upload-sarif: "true"- Deterministic action from the pinned tag
- PR comment and job summary for review
- Baseline mode for accepted known findings
- SARIF upload for GitHub code scanning
Ship review-ready reports
Turn raw config risk into a customer-ready audit pack a founder, security lead, or engineering team can act on.
mcp-guard audit --config .mcp.json \
--policy .mcp-guard-policy.json \
--output-dir mcp-guard-audit
mcp-guard verify-audit
100/100
Critical 4
High 7
Medium 2
- Server inventory and finding table
- Executive summary and remediation plan
- Checkbox remediation checklist
- Verifiable SHA-256 audit manifest
- Active vs baseline-accepted findings
- Evidence and remediation guidance
- Useful for internal security reviews
Outputs that match developer workflows.
Use one scanner across local review, pull requests, artifacts, and GitHub Security. Reports are generated locally and secret-like values are redacted before output.
SARIF
GitHub Security tab
Rules and findings map to SARIF 2.1.0 so teams can track MCP risks beside other code scanning alerts.
HTML
Readable security report
Readable risk score, server inventory, severity summary, evidence, and remediation guidance.
JSON
Automation and dashboards
Machine-readable active findings, accepted baseline findings, stable fingerprints, and summary counts.
Manifest
Verifiable audit handoff
SHA-256 hashes and byte sizes let teams confirm downloaded reports still match the generated evidence pack.
Team-ready guardrail
Accept known findings. Block only new risk.
Real repositories rarely start clean. Baseline mode lets teams commit the current reviewed state, keep those findings visible, and fail pull requests only when new high-risk MCP changes appear.
mcp-guard scan --config .mcp.json \
--write-baseline .mcp-guard-baseline.json
mcp-guard scan --config .mcp.json \
--baseline .mcp-guard-baseline.json \
--fail-on high
01
Generate
Create a JSON baseline with stable fingerprints for current findings.
02
Review
Commit the baseline after reviewing accepted risk and reasons.
03
Enforce
CI reports accepted findings but fails only on new active findings.
Transparent example
Inspect the exact input, command, and generated reports.
This is a reproducible example generated by the current CLI from a committed MCP config. The config is synthetic, but the findings and reports are real outputs from `mcp-guard`.
Input
4 MCP servers
Unpinned `npx`, broad `/` filesystem access, shell installer, Docker socket mount, remote endpoint, and secret-like values.
Result
13 findings · score 100
4 critical, 7 high, and 2 medium findings with rule IDs, evidence, and remediation guidance.
Self-serve products built around the open-source scanner.
Keep the CLI and Action free for trust and distribution. Customers can buy packaged deliverables through Stripe-hosted checkout, then receive templates, licenses, or setup intake without a sales call.
$19/mo
Recurring plan for teams running mcp-guard in private repositories.
- Private CI license verification
- Updated policy templates
- Priority MCP config examples
- Monthly rule and report updates
$199
Productized setup package for teams that want a clean first rollout.
- CLI and Action integration
- Policy and baseline review
- SARIF and PR comment setup
- Verified audit pack closeout
1. Customer pays with Stripe
Stripe-hosted checkout handles cards, wallets, receipts, and subscriptions without collecting payment details on this site.
2. Delivery follows automatically
The fulfillment worker can send purchase emails, store Pro license records, and expose a private license verification endpoint.
3. Expand when usage proves it
Keep open-source scanning free while paid plans unlock private-team workflows, policy packs, customer portal billing, and dashboard history.
Need a deeper setup beyond self-serve?
mcp-guard is an automated local scanner. Paid setup pilots are available for teams that want the CLI, GitHub Action, baseline, PR comments, and SARIF reporting wired into a real repository without sending configs to a hosted service.
Setup pilot scope
- Run the CLI against local MCP configs
- Generate Markdown, HTML, JSON, and SARIF reports
- Add the GitHub Action to pull request checks
- Create a reviewed baseline for accepted known findings
- Enable PR comments for active risk summaries
- Collect missing patterns for future rules
- Keep configs local and redact secret-like values