MCP Security Guard

CALLS every non-destructive tool of one configured server with command-injection payloads (each would only create an empty canary file) and path-traversal payloads, then reports which parameters reach a shell or the file system unchecked. Only for servers the user develops or operates, ideally a test instance in a container. Destructive tools are skipped unless include_destructive is true.

Runs the tool-poisoning checks on tool definitions you pass in (e.g. the output of tools/list from a server you are developing), without connecting to anything. Useful in CI or before publishing an MCP server.

Fixes findings in the project's own files. permissions: adds the recommended permissions.ask rules for tools that execute code, delete data or write files to .claude/settings.json (needs confirm_launch, because the servers are listed to classify their tools). pin-versions: pins unpinned npx/uvx packages in .mcp.json to the registry's current version (needs confirm_network). env-refs: replaces literal secrets in .mcp.json env/headers with ${VAR} references. Without write=true it only shows the planned edits. Every written file is backed up under ~/.claude/mcp-security/backups/ first; ~/.claude.json is never modified.

Scans the text files Claude reads besides MCP tools: CLAUDE.md, skills (and their bundled scripts), slash commands, subagents, rules and the hook configs of installed plugins, from the user, the project and every enabled plugin. Flags instruction overrides, requests to hide things from the user, invisible text, HTML comments addressed to the model, directives to read credential files, commands that upload credentials, download-and-run and encoded execution, credential-stealing scripts, and pre-approved unrestricted shell access. Read-only; launches nothing and sends nothing.

Static audit of MCP server configuration: plaintext secrets in env/headers/args/URLs, plain-HTTP remote servers, unpinned npx/uvx packages, unpinned or privileged Docker containers, pipe-to-shell launch commands, and duplicate server names across scopes. Read-only; launches nothing.

Connects to the selected MCP servers, lists their tools, and checks every name, description and schema string for tool poisoning (instruction overrides, concealment requests, hidden tags, invisible Unicode, sensitive file paths, exfiltration wording, encoded payloads), cross-server tool shadowing, and changes since the tools were last pinned (rug pulls). Never calls the scanned tools.

For servers launched with npx/uvx and similar, checks the package on its registry and in the OSV database: known vulnerabilities, known malicious versions, typosquats of popular MCP packages, non-existent names, very new packages or releases, install scripts, deprecation and npm publisher changes. Sends package names and versions to registry.npmjs.org, pypi.org and api.osv.dev; nothing else leaves the machine.

Inventory of everything the agent can run or read here: MCP servers, plugins, skills, commands, subagents, CLAUDE.md and hook configs, with SHA-256, pin status, scores and OWASP MCP Top 10 evidence. format=summary is a Markdown overview for audits; format=cyclonedx is a CycloneDX 1.6 JSON document. Static and local: nothing is launched or sent, and it holds no paths, arguments, environment or secrets.

Returns a .mcp-security.json policy that approves exactly the MCP servers configured now (and their remote hosts) and requires pinned versions. Commit it to the repository so CI, session checks and audits flag any server added later that is not on the list (shadow MCP servers). Read-only: returns the JSON, does not write it.

Lists every MCP server configured for this project (user, local and project scope in Claude Code, plus Claude Desktop) with its transport. Reads config files only; launches nothing.

Records a SHA-256 of every skill, command, subagent, rule, CLAUDE.md, plugin hook config and bundled script (user, project and each installed plugin) in ~/.claude/mcp-security/context-pins.json, so later scans and the session-start check report anything that changed after you approved it. A plugin that changes files without a new version is the rug-pull pattern. Pin only after the user has reviewed an audit_agent_context report; origins with critical or high findings are skipped unless force is true. Reads files only; launches nothing.

Records a SHA-256 hash of every tool definition of the selected servers in ~/.claude/mcp-security/pins.json, so later audits can detect rug pulls. Pin only after the user has reviewed an audit_server_tools report for these servers. Launches the servers like audit_server_tools.

Summarises the local audit log written by the plugin's hooks: MCP tool calls per server and tool, and every call where a credential was sent, a credential came back, or the output contained injected instructions. The log stores hashes and sizes only, never arguments or outputs.

Creates an approval request in the user's organisation for an MCP server (e.g. project:linear) or a plugin, when the team policy blocks it or does not list it. Use it only when the user asks. The admin decides on the command line; this tool cannot approve anything.

Opens the interactive mcp-security-guard dashboard: every configured MCP server with its score and grade, findings filterable by severity and server, the OWASP MCP Top 10 breakdown, recommended permission rules, and pin buttons. scan='config' reads files only. scan='full' starts the servers to list their tools, prompts and resources (no tool is called) and needs confirm_launch=true; ask the user first.

Shows exactly what a fleet report would send (server names, scopes, transport, package names and versions or remote hostnames, pinned or not; plugin names and versions; never paths, arguments, environment, headers or secrets). With confirm_send=true it sends it, if the admin turned fleet visibility on. Only when the user asks.

Syncs the organisation's policy from the team backend (it is then enforced next to the user's own policy) and shows the organisation, the role, the policy version and whether fleet reporting is on. Needs a team API key (MCP_SECURITY_API_KEY or the plugin's setting). Sends only the API key; the answer is cached locally.