mcpguard

MCPGuard is an advanced security scanner and firewall specifically designed for Model Context Protocol (MCP) servers. This tool offers robust security features, including:

• Vulnerability Scanning: Checks MCP server configurations against known security issues referenced in the OWASP MCP Top 10 (2026).
• Runtime Policy Enforcement: Monitors and controls tool calls made by AI agents in real-time, blocking any requests that violate established security policies.
• Audit Logging: Maintains comprehensive logs for compliance audits, capturing all interactions and decisions made by the firewall.

Key Features

Security Scanning

MCPGuard effectively identifies vulnerabilities within your MCP configurations. Studies indicate alarming statistics about security flaws, such as:

• 82% of implementations suffer from path traversal issues.
• 67% exhibit code injection vectors.
• Approximately 5.5% of public servers already have tool poisoning vulnerabilities.

This makes MCPGuard essential for proactive security management.

Real-Time Monitoring

MCPGuard operates as a proxy, intercepting communications between AI agents and MCP servers. This allows it to enforce security policies by checking each request against predefined rules, ensuring that only safe calls are executed.

Customizable Security Policies

Policies in MCPGuard are defined using YAML, providing flexibility to tailor rules according to specific security requirements. Example rules can include conditions to block unwanted tool executions or log significant actions. Here’s a snippet of how a policy might look:

version: "1.0"
name: my-security-policy
description: Custom security rules

rules:
  - id: deny-shell-exec
    name: Block shell execution
    action: deny
    priority: 100
    conditions:
      - field: tool.name
        operator: matches
        value: "(exec|shell|bash|cmd)"

Comprehensive Checks

MCPGuard conducts rigorous checks to identify and mitigate various types of vulnerabilities such as:

• Tool Poisoning
• Command Injection
• Secret Exposure
• Insecure Defaults

Example Usage

To demonstrate its capabilities, users can utilize sample configuration files:

# Scan a potentially dangerous configuration
mcpguard scan examples/dangerous-config.json

# Validate a safe configuration
mcpguard scan examples/safe-config.json

Programmatic Access

For developers, MCPGuard provides a programmatic API that allows seamless integration into applications, enabling automated scans and policy evaluations with TypeScript:

const scanner = new Scanner();
const results = scanner.scanFile('claude_desktop_config.json');
console.log(results.summary);

Conclusion

Utilizing MCPGuard enhances the security posture of MCP environments, effectively defending against common vulnerabilities through vigilant monitoring and customizable policies. This makes it a vital tool for developers and security professionals aiming to secure their AI-driven applications.