io.github.sparkvibe-io/GuardianShield
PYPI · GUARDIANSHIELD · SCANNED AUG 3
AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (Apache Software License) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 152 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability0
- Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.Unverified
Stability & Change Management0
- Stability not yet verified: our sandbox run of this package did not complete, so we have no schema to compare.Unverified
Tool Coverage0
- Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.Unverified
Capabilities0
- Protocol version not yet verified: our sandbox run of this package did not complete, so we never saw its MCP handshake.Unverified
Unverified: 4 categories
Categories scored 0 because our sandbox run of this package has not given us the schema these checks need to read. That is a gap on our side rather than a finding about the package, and we only credit what we can confirm, so the score stands at 0 until the capture succeeds. We are working through the fleet, so this normally clears without any action from you. How we score packages →
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
pypi · guardianshield
claude mcp add sparkvibe-io-guardianshield -- uvx guardianshield
codex mcp add sparkvibe-io-guardianshield -- uvx guardianshield
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"sparkvibe-io-guardianshield": {
"type": "local",
"command": [
"uvx",
"guardianshield"
],
"enabled": true
}
}
} openclaw mcp add sparkvibe-io-guardianshield --command uvx --arg guardianshield
mcp_servers:
sparkvibe-io-guardianshield:
command: "uvx"
args: ["guardianshield"] {
"mcpServers": {
"sparkvibe-io-guardianshield": {
"command": "uvx",
"args": [
"guardianshield"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 −15
- Malware scan: pass → unverified ▼ security
- 2 Aug 26 +15
- Malware scan: unverified → pass ▲ security
- 1 Aug 26 −5
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 28 Jul 26 0
- Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess. functional
- Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess. functional
- 26 Jul 26 44
First indexed and scored.
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed pypi/[email protected]
Provenance none
Ecosystem: pypi · Outcome: none
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Dependencies 0 packages
0 packages in the resolved dependency tree.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
audit_log ~68
Query the security audit log. Returns recent scan events with timestamps, scan types, finding counts, and input hashes.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | — | Maximum number of entries to return (default 50). |
| scan_type | string | — | Filter by scan type: code, input, output, secrets. |
No output schema declared.
No examples provided.
check_dependencies ~51
Check package dependencies for known vulnerabilities using the OSV.dev database. Provide a list of packages with names, versions, and ecosystems (PyPI or npm).
| Name | Type | Req | Description |
|---|---|---|---|
| dependencies | array | yes | List of dependencies to check. |
No output schema declared.
No examples provided.
check_quality_gate ~134
Scan code and evaluate findings against configurable severity thresholds. Returns a pass/fail/warn verdict suitable for CI pipelines. Exit codes: 0=pass, 1=fail.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Source code to scan. |
| fail_on | string | — | Fail if any finding at this severity or above. Default: high |
| file_path | string | — | Optional file path for context. |
| language | string | — | Optional programming language hint. |
| max_findings | integer | — | Optional absolute cap on finding count. |
| warn_on | string | — | Warn if findings at this severity. Default: medium |
No output schema declared.
No examples provided.
check_secrets ~85
Dedicated secret and credential detection. Scans text for AWS keys, GitHub tokens, Stripe keys, private keys, JWTs, Slack tokens, passwords, connection strings, Google API keys, and more. All matched secrets are redacted in findings.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | — | Optional file path for context. |
| text | string | yes | The text to scan for secrets. |
No output schema declared.
No examples provided.
export_sarif ~82
Export scan findings as SARIF 2.1.0 JSON for GitHub Code Scanning, VS Code, and CI integration
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Source code to scan. |
| engines | array | — | Analysis engines to use. |
| file_path | string | — | File path for SARIF locations. |
| language | string | yes | Programming language. |
No output schema declared.
No examples provided.
get_findings ~95
Retrieve past security findings from the audit database with optional filters by type, severity, or audit ID.
| Name | Type | Req | Description |
|---|---|---|---|
| audit_id | integer | — | Filter findings by audit log entry ID. |
| finding_type | string | — | Filter by finding type (e.g. secret, sql_injection, pii_leak). |
| limit | integer | — | Maximum findings to return (default 100). |
| severity | string | — | Filter by severity level. |
No output schema declared.
No examples provided.
get_profile ~22
Get the current safety profile configuration including scanner settings and blocked content categories.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_engines ~39
List available analysis engines with their capabilities and enabled status. Returns each engine's name, whether it is enabled in the current profile, and its capabilities.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_false_positives ~74
List active false positive records. Shows findings that have been marked as false positives, with optional filtering by scanner.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | — | Maximum number of records to return (default 100). |
| scanner | string | — | Optional filter by scanner name (e.g. 'code_scanner', 'secrets'). |
No output schema declared.
No examples provided.
mark_false_positive ~73
Mark a security finding as a false positive. The finding will be flagged in future scans, and similar patterns at other locations will be annotated as potential false positives.
| Name | Type | Req | Description |
|---|---|---|---|
| finding | object | yes | The finding dict as returned by a scan tool. |
| reason | string | — | Optional explanation of why this is a false positive. |
No output schema declared.
No examples provided.
parse_manifest ~123
Parse a dependency manifest file into a structured list of dependencies. Auto-detects format from the filename. Supports: requirements.txt, package.json, pyproject.toml, package-lock.json, yarn.lock, pnpm-lock.yaml, Pipfile.lock, go.mod, go.sum, composer.json, composer.lock.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | The contents of the manifest file. |
| filename | string | yes | Filename for format detection (e.g. 'requirements.txt', 'package.json', 'package-lock.json', 'yarn.lock', 'go.mod', 'composer.json'). |
No output schema declared.
No examples provided.
save_baseline ~102
Scan code and save the findings as a baseline JSON file. On subsequent scans with scan_with_baseline, only NEW findings (not in the baseline) are reported.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Source code to scan. |
| file_path | string | — | Optional file path for context. |
| language | string | — | Optional programming language hint. |
| output_path | string | — | Path to save the baseline file. Default: .guardianshield-baseline.json |
No output schema declared.
No examples provided.
scan_code ~103
Scan source code for security vulnerabilities (SQL injection, XSS, command injection, path traversal) and hardcoded secrets/credentials. Returns a list of findings with severity, type, and remediation guidance.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The source code to scan. |
| engines | array | — | Optional list of engine names to use for this scan. |
| file_path | string | — | Optional file path for context in findings. |
| language | string | — | Optional programming language hint. |
No output schema declared.
No examples provided.
scan_dependencies ~82
Recursively scan a directory for manifest/lockfiles (requirements.txt, package.json, go.mod, composer.json, etc.), parse dependencies, and check them for known vulnerabilities using the OSV.dev database.
| Name | Type | Req | Description |
|---|---|---|---|
| exclude | array | — | Glob patterns to skip (e.g. ["vendor/*"]). |
| path | string | yes | Root directory to scan for manifest files. |
No output schema declared.
No examples provided.
scan_diff ~59
Scan a unified diff (e.g. from git diff) for vulnerabilities. Only added lines are scanned; findings have correct line numbers and file paths from the diff context.
| Name | Type | Req | Description |
|---|---|---|---|
| diff | string | yes | Unified diff text (e.g. from git diff). |
No output schema declared.
No examples provided.
scan_directory ~90
Recursively scan a directory for vulnerabilities and secrets. Supports extension filtering, exclude patterns, and reports progress. Returns all findings across all scanned files.
| Name | Type | Req | Description |
|---|---|---|---|
| exclude | array | — | Glob patterns to skip (e.g. ["node_modules/*"]). |
| extensions | array | — | File extensions to include (e.g. [".py", ".js"]). |
| path | string | yes | Root directory to scan. |
No output schema declared.
No examples provided.
scan_file ~71
Scan a single source file for vulnerabilities and secrets. Auto-detects language from file extension. Returns findings with line numbers, severity, CWE IDs, and remediation.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | — | Optional language hint (auto-detected from extension). |
| path | string | yes | Absolute or relative path to the file. |
No output schema declared.
No examples provided.
scan_files ~39
Scan multiple files in one call. Returns findings grouped by file with a summary of total findings.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | List of files to scan. |
No output schema declared.
No examples provided.
scan_input ~61
Check user or agent input for prompt injection attempts. Detects instruction override, role hijacking, system prompt extraction, delimiter abuse, ChatML injection, jailbreak keywords, and encoding evasion.
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | The input text to check for injection attempts. |
No output schema declared.
No examples provided.
scan_output ~66
Check AI-generated output for PII leaks (email, SSN, credit card, phone, IP) and content policy violations (violence, self-harm, illegal activity). PII is automatically redacted in findings.
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | The AI output text to scan. |
No output schema declared.
No examples provided.
scan_with_baseline ~99
Scan code and compare against a saved baseline, returning only NEW findings that are not in the baseline. Use save_baseline first to create a baseline.
| Name | Type | Req | Description |
|---|---|---|---|
| baseline_path | string | — | Path to the baseline file. Default: .guardianshield-baseline.json |
| code | string | yes | Source code to scan. |
| file_path | string | — | Optional file path for context. |
| language | string | — | Optional programming language hint. |
No output schema declared.
No examples provided.
set_engine ~55
Set which analysis engines are active for code scanning. Accepts a list of engine names to enable for the current session. Available engines can be listed with list_engines.
| Name | Type | Req | Description |
|---|---|---|---|
| engines | array | yes | List of engine names to enable. |
No output schema declared.
No examples provided.
set_profile ~48
Switch to a different safety profile. Available profiles: general, education, healthcare, finance, children. Each profile adjusts scanner sensitivity and blocked categories.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Profile name to activate. |
No output schema declared.
No examples provided.
shield_status ~26
Get GuardianShield health and configuration status including active profile, enabled scanners, and audit statistics.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
sync_vulnerabilities ~69
Sync the local OSV vulnerability database for a given ecosystem. Call this to update the cache before checking dependencies.
| Name | Type | Req | Description |
|---|---|---|---|
| ecosystem | string | yes | Ecosystem to sync (PyPI, npm, Go, or Packagist). |
| packages | array | — | Optional list of package names to sync. |
No output schema declared.
No examples provided.
test_pattern ~71
Test a regex pattern against sample code. Returns match details including positions and matched text. Useful for developing and debugging custom vulnerability patterns.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | — | Optional language context for the pattern. |
| regex | string | yes | The regex pattern to test. |
| sample | string | yes | Sample code to test against. |
No output schema declared.
No examples provided.
unmark_false_positive ~46
Remove a false positive record by its fingerprint. The finding will no longer be flagged in future scans.
| Name | Type | Req | Description |
|---|---|---|---|
| fingerprint | string | yes | The fingerprint of the false positive record to remove. |
No output schema declared.
No examples provided.