armguard-mcp
PYPI · ARMGUARD-MCP
Safety-first MCP server for ROS 2 robot arms: server-side safety envelope, human approval, audit
Available components
Last scanned (6 hours ago)
Scores higher than 80% of PyPI servers
Category IoT and Hardware
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 29 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to Lynn-hh/armguard-mcp). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 11 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability73
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1800 tokens (~81/item across 22 items; 22 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage96
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 86% of tool parameters carry a description.Partial
- Structured output schemas are declared (95% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 30 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 29 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
- 27 Oct 26 0
- Package version: 0.1.0 → 0.1.1 functional
- 26 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 25 Oct 26 +16
- Malware scan: pass → unverified ▼ security
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: 100 functional
- First check of Schema quality: pass functional
- First check of Schema quality: good functional
- First check of Tool coverage: 86 functional
- First check of Tool coverage: 95 functional
- Package version: 0.1.0 → 0.1.1 functional
- 20 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 19 Oct 26 34
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/armguard-mcp@0.1.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | Lynn-hh/armguard-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/Lynn-hh/armguard-mcp/.github/workflows/release.yml@refs/tags/v0.1.1 |
| Rekor log index | 3448629971 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:64b1088aa6b3ff37929d05d510bfb4aebef123b0fa28d98ed29f10ec8e73fe97 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 29 packages
| Packages resolved | 29 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
camera_snapshot ~70
Grab the latest image from an allowlisted camera topic (see get_safety_envelope.camera_topics). Returns the image plus JSON metadata (width, height, stamp). Images wider than the policy's max_image_width are downscaled (or refused if Pillow is not installed).
| Name | Type | Req | Description |
|---|---|---|---|
| topic | string | yes | – |
No output schema declared.
No examples provided.
error_recovery ~45
Clear the robot's error/reflex state (e.g. after a collision reflex). May require human approval. Refused while the software e-stop is active (reset it first).
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | – |
| message | string | yes | – |
| ok | boolean | yes | – |
No examples provided.
estop ~87
SOFTWARE E-STOP: stop all motion (arm and gripper), invalidate every plan and refuse motion/gripper/control tools until a human approves reset_estop. Always available, never rate limited, never needs approval, accepts any reason. This is not a substitute for the hardware e-stop.
| Name | Type | Req | Description |
|---|---|---|---|
| reason | – | – | Optional short reason, shown to the human who resets the e-stop |
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | yes | – |
| estop_event | – | – | Number of the latched e-stop event |
| estopped | boolean | yes | – |
| estopped_at | – | – | – |
| executing_plan_id | – | – | – |
| force_violation_latched | boolean | yes | – |
| last_violation | – | – | – |
| note | string | – | – |
| reason | – | – | – |
| reason_source | – | – | Who gave the reason: the AI agent (via estop) or the server itself |
No examples provided.
execute_plan ~136
EXECUTE a previously planned motion on the robot. The server re-validates the plan against the safety envelope, rejects stale/expired/used plans, may ask a human to approve (depending on policy), monitors contact force while moving (aborting and latching an e-stop above the limit), and streams progress. Plan handles are single-use and one plan executes at a time. Refused if the robot provides no force estimate (unless the policy allows it). Cancelling the call stops the robot. In dry-run mode nothing moves.
| Name | Type | Req | Description |
|---|---|---|---|
| plan_id | string | yes | plan_id returned by a plan_* tool |
| Name | Type | Req | Description |
|---|---|---|---|
| approval | string | yes | How the execution was authorised |
| dry_run | boolean | yes | – |
| duration_s | number | yes | – |
| executed | boolean | yes | – |
| final_ee_pose | – | – | – |
| final_joint_positions | – | – | – |
| max_observed_force_n | – | – | – |
| message | string | yes | – |
| plan_id | string | yes | – |
| status | string | yes | – |
No examples provided.
get_audit_tail ~41
The last n audit-log events (tool calls, approvals, denials, e-stops). Images are redacted.
| Name | Type | Req | Description |
|---|---|---|---|
| n | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| events | array | yes | – |
No examples provided.
get_motion_status ~30
Whether a plan is executing, its progress (0..1) and the result of the last execution.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| executing | boolean | yes | – |
| last_result | – | – | – |
| message | string | – | – |
| plan_id | – | – | – |
| progress | number | – | 0..1 fraction of the active plan |
No examples provided.
get_robot_state ~50
Current joint positions [rad], TCP pose [m, quaternion xyzw] in the robot base frame, estimated external wrench [N, N*m], gripper state and safety status. Read-only.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| backend | string | yes | – |
| ee_pose | – | yes | – |
| gripper | – | – | – |
| joint_state | – | yes | – |
| robot | string | yes | – |
| safety | – | yes | – |
| wrench | – | – | – |
No examples provided.
get_safety_envelope ~63
The limits the server enforces (joint limits, workspace box, keep-out zones, speed/step caps, force thresholds, gripper limits, approval mode). Read this before planning and stay inside it: violations are rejected server-side and cannot be overridden.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| approval | – | yes | – |
| base_frame | string | yes | – |
| camera_topics | array | yes | – |
| controllers_allowlist | array | yes | – |
| dry_run | boolean | yes | – |
| ee_frame | string | yes | – |
| enabled_tool_groups | array | yes | – |
| force | – | yes | – |
| gripper | – | yes | – |
| home_joint_positions | array | yes | – |
| joint_limits | object | yes | – |
| joint_names | array | yes | – |
| max_image_width | integer | yes | – |
| motion | – | yes | – |
| rate_limits | – | yes | – |
| robot | string | yes | – |
| summary | string | yes | – |
| workspace | – | yes | – |
No examples provided.
get_safety_status ~32
E-stop state, latched force violation, dry-run flag and the last envelope violation. Never rate limited.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | yes | – |
| estop_event | – | – | Number of the latched e-stop event |
| estopped | boolean | yes | – |
| estopped_at | – | – | – |
| executing_plan_id | – | – | – |
| force_violation_latched | boolean | yes | – |
| last_violation | – | – | – |
| note | string | – | – |
| reason | – | – | – |
| reason_source | – | – | Who gave the reason: the AI agent (via estop) or the server itself |
No examples provided.
gripper_grasp ~168
Close the gripper on an object of about width_m [m] with force_n [N]. Succeeds (ok=true) only if the fingers stop within [width - epsilon_inner, width + epsilon_outer]. Forces above the policy maximum are rejected, not clamped.
| Name | Type | Req | Description |
|---|---|---|---|
| epsilon_inner_m | number | – | Tolerance [m]: the grasp succeeds down to width_m - epsilon_inner_m |
| epsilon_outer_m | number | – | Tolerance [m]: the grasp succeeds up to width_m + epsilon_outer_m |
| force_n | number | yes | Grasp force [N]; must not exceed the policy maximum |
| speed_mps | – | – | Finger speed [m/s]; default = policy max |
| width_m | number | yes | Expected object width [m] |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | – |
| message | string | yes | – |
| ok | boolean | yes | – |
No examples provided.
gripper_home ~21
Home (fully open and calibrate) the gripper.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | – |
| message | string | yes | – |
| ok | boolean | yes | – |
No examples provided.
gripper_move ~61
Move the gripper fingers to an opening width [m] without applying grasp force.
| Name | Type | Req | Description |
|---|---|---|---|
| speed_mps | – | – | Finger speed [m/s]; default = policy max |
| width_m | number | yes | Target finger opening [m], within the policy range |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | – |
| message | string | yes | – |
| ok | boolean | yes | – |
No examples provided.
list_controllers ~28
ros2_control controllers with their type and state, plus which ones the policy lets you switch.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| controllers | array | yes | – |
| switchable | array | yes | Controllers the policy allows to be (de)activated |
No examples provided.
list_ros_graph ~39
ROS 2 nodes, topics, services and actions visible to the server. Read-only; you cannot publish or call arbitrary services through this server.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| actions | array | yes | – |
| nodes | array | yes | – |
| services | array | yes | – |
| topics | array | yes | – |
No examples provided.
lookup_transform ~73
Pose of source_frame expressed in target_frame (tf2 semantics), e.g. target_frame='fr3_link0', source_frame='fr3_hand_tcp'. Position in metres, orientation as a quaternion (x, y, z, w).
| Name | Type | Req | Description |
|---|---|---|---|
| source_frame | string | yes | – |
| target_frame | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| frame_id | string | yes | Frame the pose is expressed in |
| orientation | – | – | Unit quaternion (x, y, z, w) |
| position | – | yes | – |
No examples provided.
plan_cartesian_path ~119
Plan (do NOT move) a straight-line TCP path through the waypoints [m]. Total TCP path length is capped by the policy (max_cartesian_step_m). Returns a plan summary validated against the envelope.
| Name | Type | Req | Description |
|---|---|---|---|
| acceleration_scaling | – | – | Fraction of max joint accel (0, 1] |
| frame_id | – | – | Frame of the waypoints; default = base frame |
| velocity_scaling | – | – | Fraction of max joint speed (0, 1] |
| waypoints | array | yes | TCP waypoints, in order |
| Name | Type | Req | Description |
|---|---|---|---|
| acceleration_scaling | number | yes | – |
| dry_run | boolean | yes | – |
| duration_s | number | yes | – |
| executable | boolean | yes | – |
| expires_at | – | – | ISO-8601 UTC expiry of the plan handle |
| final_ee_pose | – | yes | – |
| final_joint_positions | array | yes | – |
| force_monitoring | string | yes | Whether the backend currently provides an external wrench estimate. Without one the server cannot enforce the contact force limit, and execute_plan refuses to move unless the policy sets force.requir… |
| kind | string | yes | – |
| max_joint_acceleration_ratio | number | yes | Peak joint acceleration (estimated from the waypoint timing) as a fraction of the joint limit |
| max_joint_travel_rad | number | yes | – |
| max_joint_velocity_ratio | number | yes | Peak joint speed as a fraction of the joint limit |
| notes | array | – | – |
| num_waypoints | integer | yes | – |
| plan_id | string | yes | – |
| requires_approval | boolean | yes | – |
| start_joint_positions | array | yes | – |
| status | string | yes | rejected plans can never be executed; needs_approval requires a human to approve |
| tcp_path_length_m | number | yes | – |
| velocity_scaling | number | yes | – |
| violations | array | – | – |
No examples provided.
plan_to_joints ~159
Plan (do NOT move) a joint-space motion from the current state to joint_positions [rad]. Returns a plan summary validated against the safety envelope; if status is not 'rejected', pass plan_id to execute_plan. Scaling above the policy cap is clamped.
| Name | Type | Req | Description |
|---|---|---|---|
| acceleration_scaling | – | – | Fraction of max joint accel (0, 1] |
| joint_positions | array | yes | Target joint positions [rad], one per joint in the order ['fr3_joint1', 'fr3_joint2', 'fr3_joint3', 'fr3_joint4', 'fr3_joint5', 'fr3_joint6', 'fr3_joint7'] |
| velocity_scaling | – | – | Fraction of max joint speed (0, 1] |
| Name | Type | Req | Description |
|---|---|---|---|
| acceleration_scaling | number | yes | – |
| dry_run | boolean | yes | – |
| duration_s | number | yes | – |
| executable | boolean | yes | – |
| expires_at | – | – | ISO-8601 UTC expiry of the plan handle |
| final_ee_pose | – | yes | – |
| final_joint_positions | array | yes | – |
| force_monitoring | string | yes | Whether the backend currently provides an external wrench estimate. Without one the server cannot enforce the contact force limit, and execute_plan refuses to move unless the policy sets force.requir… |
| kind | string | yes | – |
| max_joint_acceleration_ratio | number | yes | Peak joint acceleration (estimated from the waypoint timing) as a fraction of the joint limit |
| max_joint_travel_rad | number | yes | – |
| max_joint_velocity_ratio | number | yes | Peak joint speed as a fraction of the joint limit |
| notes | array | – | – |
| num_waypoints | integer | yes | – |
| plan_id | string | yes | – |
| requires_approval | boolean | yes | – |
| start_joint_positions | array | yes | – |
| status | string | yes | rejected plans can never be executed; needs_approval requires a human to approve |
| tcp_path_length_m | number | yes | – |
| velocity_scaling | number | yes | – |
| violations | array | – | – |
No examples provided.
plan_to_pose ~149
Plan (do NOT move) a motion that brings the TCP to a pose. Uses inverse kinematics; the path is a joint-space interpolation (the TCP does not move in a straight line - use plan_cartesian_path for that). Returns a plan summary validated against the safety envelope.
| Name | Type | Req | Description |
|---|---|---|---|
| acceleration_scaling | – | – | Fraction of max joint accel (0, 1] |
| frame_id | – | – | Frame of the target; default = robot base frame |
| orientation | – | – | Target TCP orientation (x, y, z, w); omit to keep current |
| position | – | yes | Target TCP position [m] |
| velocity_scaling | – | – | Fraction of max joint speed (0, 1] |
| Name | Type | Req | Description |
|---|---|---|---|
| acceleration_scaling | number | yes | – |
| dry_run | boolean | yes | – |
| duration_s | number | yes | – |
| executable | boolean | yes | – |
| expires_at | – | – | ISO-8601 UTC expiry of the plan handle |
| final_ee_pose | – | yes | – |
| final_joint_positions | array | yes | – |
| force_monitoring | string | yes | Whether the backend currently provides an external wrench estimate. Without one the server cannot enforce the contact force limit, and execute_plan refuses to move unless the policy sets force.requir… |
| kind | string | yes | – |
| max_joint_acceleration_ratio | number | yes | Peak joint acceleration (estimated from the waypoint timing) as a fraction of the joint limit |
| max_joint_travel_rad | number | yes | – |
| max_joint_velocity_ratio | number | yes | Peak joint speed as a fraction of the joint limit |
| notes | array | – | – |
| num_waypoints | integer | yes | – |
| plan_id | string | yes | – |
| requires_approval | boolean | yes | – |
| start_joint_positions | array | yes | – |
| status | string | yes | rejected plans can never be executed; needs_approval requires a human to approve |
| tcp_path_length_m | number | yes | – |
| velocity_scaling | number | yes | – |
| violations | array | – | – |
No examples provided.
reset_estop ~71
Release the software e-stop (and any latched force violation). ALWAYS requires human approval via the MCP client, regardless of the approval mode. An approval only releases the e-stop event it was shown for; if another e-stop is latched while the prompt is open, call reset_estop again.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | yes | – |
| estop_event | – | – | Number of the latched e-stop event |
| estopped | boolean | yes | – |
| estopped_at | – | – | – |
| executing_plan_id | – | – | – |
| force_violation_latched | boolean | yes | – |
| last_violation | – | – | – |
| note | string | – | – |
| reason | – | – | – |
| reason_source | – | – | Who gave the reason: the AI agent (via estop) or the server itself |
No examples provided.
set_collision_thresholds ~71
Set the robot's collision (reflex) thresholds. Values above the policy maxima are rejected.
| Name | Type | Req | Description |
|---|---|---|---|
| force_n | number | yes | Collision force threshold [N]; <= policy max_contact_force_n |
| torque_nm | number | yes | Collision torque threshold [N*m]; <= policy max_contact_torque_nm |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | – |
| message | string | yes | – |
| ok | boolean | yes | – |
No examples provided.
stop_motion ~50
Stop the current motion immediately: the arm trajectory and any gripper action. Always available, never rate limited, never needs approval. Does not latch; use estop to also block further motion.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | – |
| message | string | yes | – |
| ok | boolean | yes | – |
No examples provided.
switch_controllers ~67
Activate/deactivate ros2_control controllers. Only controllers in the policy allowlist may be switched; a human may need to approve.
| Name | Type | Req | Description |
|---|---|---|---|
| activate | array | – | Controllers to activate (must be allowlisted) |
| deactivate | array | – | Controllers to deactivate (must be allowlisted) |
| Name | Type | Req | Description |
|---|---|---|---|
| controllers | array | yes | – |
| switchable | array | yes | Controllers the policy allows to be (de)activated |
No examples provided.
How do I install the armguard-mcp server?
armguard-mcp runs locally as a PyPI package, launched with uvx armguard-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · armguard-mcp
claude mcp add lynn-hh-armguard-mcp -- uvx armguard-mcp
What is the armguard-mcp server?
armguard-mcp is listed in the public MCP registry as io.github.Lynn-hh/armguard-mcp. Safety-first MCP server for ROS 2 robot arms: server-side safety envelope, human approval, audit. This page covers its PyPI package (armguard-mcp).
Is the armguard-mcp server safe to use?
armguard-mcp scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the armguard-mcp server expose?
armguard-mcp exposes 22 tools: get_robot_state, get_safety_envelope, lookup_transform, list_controllers, list_ros_graph, and 17 more. Their descriptions and schemas cost roughly 1,630 tokens of context every time the server is loaded.
Is the armguard-mcp server still maintained?
armguard-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the armguard-mcp server under?
armguard-mcp declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.