# MCP Security Guard (npm · mcp-security-guard)

Audit MCP servers for tool poisoning, rug pulls and supply-chain risk (OWASP MCP Top 10).

- Trust score: 80/100 (high trust)
- Change this week: +31
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-18

## Components

- npm · `mcp-security-guard`: 80/100 (this document), [markdown](https://verifymcp.io/servers/petrovicistefan-mcp-security-guard/mcp-security-guard.md), [page](https://verifymcp.io/servers/petrovicistefan-mcp-security-guard/mcp-security-guard)

## Channel facts

- Registry: `npm`
- Package: `mcp-security-guard`
- Version: `0.9.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-18.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 93 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to petrovicistefan/mcp-security-guard).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 8 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 78/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2358 tokens (~131/item across 18 items; 17 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 85/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 55% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
  - Supports UI / widget rendering.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the MCP Security Guard server?

MCP Security Guard runs locally as an npm package, launched with npx -y mcp-security-guard. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add petrovicistefan-mcp-security-guard -- npx -y mcp-security-guard
```

### Cursor

```json
{
  "mcpServers": {
    "petrovicistefan-mcp-security-guard": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-security-guard"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "petrovicistefan-mcp-security-guard": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-security-guard"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add petrovicistefan-mcp-security-guard -- npx -y mcp-security-guard
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "petrovicistefan-mcp-security-guard": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mcp-security-guard"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add petrovicistefan-mcp-security-guard --command npx --arg -y --arg mcp-security-guard
```

### Hermes

```yaml
mcp_servers:
  petrovicistefan-mcp-security-guard:
    command: "npx"
    args: ["-y", "mcp-security-guard"]
```

### Netclaw

```json
{
  "McpServers": {
    "petrovicistefan-mcp-security-guard": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "mcp-security-guard"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add petrovicistefan-mcp-security-guard -t stdio -c npx -a -y mcp-security-guard
```

### Other

```json
{
  "mcpServers": {
    "petrovicistefan-mcp-security-guard": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-security-guard"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-14 (score 80, +31)

- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 55
- [functional] First check of Destructive annotations: pass
- [functional] First check of Schema quality: fail
- [functional] First check of Capabilities: pass
- [functional] First check of Schema quality: good

### 2026-10-13 (score 49, 0)

- [functional improvement] Security disclosure: unverified → pass

### 2026-10-12 (score 49, 0)

- [functional regression] Security disclosure: pass → unverified
- [functional] Package version: 0.8.1 → 0.9.0

### 2026-10-08 (score 49)

First indexed and scored.

## MCP tools (17)

### `list_mcp_servers` (~61 tokens)

List configured MCP servers

Lists every MCP server configured for this project (user, local and project scope in Claude Code, plus Claude Desktop) with its transport. Reads config files only; launches nothing.

Input parameters:

- `project_dir` (string): Project directory. Defaults to the current project.

### `audit_mcp_config` (~87 tokens)

Audit MCP configuration

Static audit of MCP server configuration: plaintext secrets in env/headers/args/URLs, plain-HTTP remote servers, unpinned npx/uvx packages, unpinned or privileged Docker containers, pipe-to-shell launch commands, and duplicate server names across scopes. Read-only; launches nothing.

Input parameters:

- `project_dir` (string): Project directory. Defaults to the current project.

### `audit_agent_context` (~167 tokens)

Audit skills, commands, agents and CLAUDE.md

Scans the text files Claude reads besides MCP tools: CLAUDE.md, skills (and their bundled scripts), slash commands, subagents, rules and the hook configs of installed plugins, from the user, the project and every enabled plugin. Flags instruction overrides, requests to hide things from the user, invisible text, HTML comments addressed to the model, directives to read credential files, commands that upload credentials, download-and-run and encoded execution, credential-stealing scripts, and pre-approved unrestricted shell access. Read-only; launches nothing and sends nothing.

Input parameters:

- `project_dir` (string): Project directory. Defaults to the current project.
- `project_only` (boolean): Only the project's own files (CLAUDE.md, .claude/). Use for repositories you are about to trust.

### `pin_context` (~179 tokens)

Pin skills, commands, agents and CLAUDE.md

Records a SHA-256 of every skill, command, subagent, rule, CLAUDE.md, plugin hook config and bundled script (user, project and each installed plugin) in ~/.claude/mcp-security/context-pins.json, so later scans and the session-start check report anything that changed after you approved it. A plugin that changes files without a new version is the rug-pull pattern. Pin only after the user has reviewed an audit_agent_context report; origins with critical or high findings are skipped unless force is true. Reads files only; launches nothing.

Input parameters:

- `force` (boolean): Pin origins that still have critical or high findings. Only when the user explicitly accepts them.
- `origins` (array): Only these origins: "user", "project", "plugin:<name>". Default: all.
- `project_dir` (string)

### `audit_server_tools` (~178 tokens)

Audit MCP tool definitions

Connects to the selected MCP servers, lists their tools, and checks every name, description and schema string for tool poisoning (instruction overrides, concealment requests, hidden tags, invisible Unicode, sensitive file paths, exfiltration wording, encoded payloads), cross-server tool shadowing, and changes since the tools were last pinned (rug pulls). Never calls the scanned tools.

Input parameters:

- `confirm_launch` (boolean, required): Must be true. Scanning starts each server process (stdio) or connects to it (HTTP); only initialize and tools/list are sent and no tool is called. Ask the user first.
- `project_dir` (string)
- `servers` (array, required): Server names to scan, optionally as "scope:name" (e.g. "project:github"). Use ["*"] for all.
- `timeout_seconds` (integer)

### `pin_tools` (~160 tokens)

Pin MCP tool definitions

Records a SHA-256 hash of every tool definition of the selected servers in ~/.claude/mcp-security/pins.json, so later audits can detect rug pulls. Pin only after the user has reviewed an audit_server_tools report for these servers. Launches the servers like audit_server_tools.

Input parameters:

- `confirm_launch` (boolean, required): Must be true. Scanning starts each server process (stdio) or connects to it (HTTP); only initialize and tools/list are sent and no tool is called. Ask the user first.
- `project_dir` (string)
- `servers` (array, required): Server names to scan, optionally as "scope:name" (e.g. "project:github"). Use ["*"] for all.
- `timeout_seconds` (integer)

### `analyze_tool_definitions` (~74 tokens)

Analyze tool definitions (offline)

Runs the tool-poisoning checks on tool definitions you pass in (e.g. the output of tools/list from a server you are developing), without connecting to anything. Useful in CI or before publishing an MCP server.

Input parameters:

- `server_name` (string, required): Label used in the report.
- `tools` (array, required)

### `check_supply_chain` (~179 tokens)

Check MCP server packages (npm/PyPI)

For servers launched with npx/uvx and similar, checks the package on its registry and in the OSV database: known vulnerabilities, known malicious versions, typosquats of popular MCP packages, non-existent names, very new packages or releases, install scripts, deprecation and npm publisher changes. Sends package names and versions to registry.npmjs.org, pypi.org and api.osv.dev; nothing else leaves the machine.

Input parameters:

- `confirm_network` (boolean, required): Must be true: package names and versions are sent to the registries and OSV.
- `project_dir` (string)
- `scan_images` (boolean): Also scan container images of Docker-based servers with Trivy or Grype if installed (may pull images and the scanner database).
- `servers` (array): Server names, or ["*"] for all.

### `adversarial_test` (~216 tokens)

Adversarial test of your own MCP server

CALLS every non-destructive tool of one configured server with command-injection payloads (each would only create an empty canary file) and path-traversal payloads, then reports which parameters reach a shell or the file system unchecked. Only for servers the user develops or operates, ideally a test instance in a container. Destructive tools are skipped unless include_destructive is true.

Input parameters:

- `canary_dir` (string): Writable directory as seen by the server (default: the OS temp directory). For a container, mount a host directory and pass host_canary_dir too.
- `confirm_launch` (boolean, required): Must be true: the user agreed that the server is started and its tools are called.
- `host_canary_dir` (string)
- `i_own_this_server` (boolean, required): Must be true: the user confirmed they own or operate this server.
- `include_destructive` (boolean)
- `project_dir` (string)
- `server` (string, required): Server name, optionally "scope:name".

### `security_dashboard` (~116 tokens)

Security dashboard

Opens the interactive mcp-security-guard dashboard: every configured MCP server with its score and grade, findings filterable by severity and server, the OWASP MCP Top 10 breakdown, recommended permission rules, and pin buttons. scan='config' reads files only. scan='full' starts the servers to list their tools, prompts and resources (no tool is called) and needs confirm_launch=true; ask the user first.

Input parameters:

- `confirm_launch` (boolean)
- `project_dir` (string)
- `scan` (string)

### `apply_fixes` (~218 tokens)

Apply recommended fixes

Fixes findings in the project's own files. permissions: adds the recommended permissions.ask rules for tools that execute code, delete data or write files to .claude/settings.json (needs confirm_launch, because the servers are listed to classify their tools). pin-versions: pins unpinned npx/uvx packages in .mcp.json to the registry's current version (needs confirm_network). env-refs: replaces literal secrets in .mcp.json env/headers with ${VAR} references. Without write=true it only shows the planned edits. Every written file is backed up under ~/.claude/mcp-security/backups/ first; ~/.claude.json is never modified.

Input parameters:

- `confirm_launch` (boolean)
- `confirm_network` (boolean)
- `fixes` (array, required)
- `project_dir` (string)
- `servers` (array): Servers considered for the permissions fix.
- `write` (boolean): false = dry run. Show the plan to the user first, then call again with write=true after they agree.

### `generate_policy` (~83 tokens)

Generate an approved-server policy

Returns a .mcp-security.json policy that approves exactly the MCP servers configured now (and their remote hosts) and requires pinned versions. Commit it to the repository so CI, session checks and audits flag any server added later that is not on the list (shadow MCP servers). Read-only: returns the JSON, does not write it.

Input parameters:

- `project_dir` (string)

### `team_status` (~103 tokens)

Team plan status

Syncs the organisation's policy from the team backend (it is then enforced next to the user's own policy) and shows the organisation, the role, the policy version and whether fleet reporting is on. Needs a team API key (MCP_SECURITY_API_KEY or the plugin's setting). Sends only the API key; the answer is cached locally.

Input parameters:

- `confirm_network` (boolean, required): Must be true: the API key is sent to the team backend. Ask the user first.

### `request_approval` (~127 tokens)

Ask the admin to approve a server or plugin

Creates an approval request in the user's organisation for an MCP server (e.g. project:linear) or a plugin, when the team policy blocks it or does not list it. Use it only when the user asks. The admin decides on the command line; this tool cannot approve anything.

Input parameters:

- `confirm_network` (boolean, required): Must be true: the request is sent to the team backend. Ask the user first.
- `identity` (string, required): Server as "scope:name" or plugin name.
- `kind` (string, required)
- `note` (string): Why the user needs it.

### `team_report` (~109 tokens)

Report servers and plugins to the team

Shows exactly what a fleet report would send (server names, scopes, transport, package names and versions or remote hostnames, pinned or not; plugin names and versions; never paths, arguments, environment, headers or secrets). With confirm_send=true it sends it, if the admin turned fleet visibility on. Only when the user asks.

Input parameters:

- `confirm_send` (boolean): false = preview only. true = send, after the user has seen the preview and agreed.
- `project_dir` (string)

### `export_bom` (~137 tokens)

Export the agent bill of materials

Inventory of everything the agent can run or read here: MCP servers, plugins, skills, commands, subagents, CLAUDE.md and hook configs, with SHA-256, pin status, scores and OWASP MCP Top 10 evidence. format=summary is a Markdown overview for audits; format=cyclonedx is a CycloneDX 1.6 JSON document. Static and local: nothing is launched or sent, and it holds no paths, arguments, environment or secrets.

Input parameters:

- `format` (string)
- `project_dir` (string)
- `project_only` (boolean): Only the project's own servers and files.

### `query_audit_log` (~79 tokens)

Query the MCP call audit log

Summarises the local audit log written by the plugin's hooks: MCP tool calls per server and tool, and every call where a credential was sent, a credential came back, or the output contained injected instructions. The log stores hashes and sizes only, never arguments or outputs.

Input parameters:

- `since_hours` (number): Look-back window in hours.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/petrovicistefan-mcp-security-guard/mcp-security-guard#diagnostics

## Score history

- 2026-10-18: 80
- 2026-10-17: 80
- 2026-10-16: 80
- 2026-10-15: 80
- 2026-10-14: 80
- 2026-10-13: 49
- 2026-10-12: 49
- 2026-10-08: 49

## Common questions

### What is the MCP Security Guard server?

MCP Security Guard is listed in the public MCP registry as io.github.petrovicistefan/mcp-security-guard. Audit MCP servers for tool poisoning, rug pulls and supply-chain risk (OWASP MCP Top 10). This page covers its npm package (mcp-security-guard).

### Is the MCP Security Guard server safe to use?

MCP Security Guard scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 18 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the MCP Security Guard server expose?

MCP Security Guard exposes 17 tools: list_mcp_servers, audit_mcp_config, audit_agent_context, pin_context, audit_server_tools, and 12 more. Their descriptions and schemas cost roughly 2,273 tokens of context every time the server is loaded.

### Is the MCP Security Guard server still maintained?

MCP Security Guard is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the MCP Security Guard server under?

MCP Security Guard declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/mcp-security-guard
- Socket report: https://socket.dev/npm/package/mcp-security-guard
- Repository: https://github.com/petrovicistefan/mcp-security-guard
- Changelog RSS feed: https://verifymcp.io/servers/petrovicistefan-mcp-security-guard/mcp-security-guard.xml
- Changelog JSON feed: https://verifymcp.io/servers/petrovicistefan-mcp-security-guard/mcp-security-guard.json
- HTML version of this page: https://verifymcp.io/servers/petrovicistefan-mcp-security-guard/mcp-security-guard