@thornguard/cli

Secure local launcher for ThornGuard-protected MCP connections.

@thornguard/cli stores your ThornGuard license locally, creates a per-device activation automatically, keeps upstream secrets out of visible MCP client arguments, and generates editor-specific config that launches protected connections through ThornGuard.

Install

npm install -g @thornguard/cli

Requires Node.js 18 or newer.

Quick Start

The fastest path is the interactive onboarding flow:

thornguard onboard

Or step by step:

thornguard auth login

thornguard profile add my-server \
  --target-url https://my-mcp-server.example/mcp

thornguard print-config --client claude my-server --apply
thornguard doctor my-server

What The CLI Does

• Stores your ThornGuard license key in local secure storage where supported
• Creates and reuses a local activation for the current machine automatically
• Stores profile metadata for protected MCP connections
• Keeps upstream bearer tokens out of visible MCP client config when possible
• Prints or applies config for supported MCP clients
• Scans existing editor configs and helps protect remote MCP servers
• Runs diagnostics with actionable hints

Supported Clients

• Claude Desktop
• VS Code
• Cursor
• Zed

Common Commands

| Command | Description | |---------|-------------| | thornguard onboard | Interactive setup for license, profile, and verification | | thornguard auth login | Store your ThornGuard license key | | thornguard auth logout | Remove the stored license key | | thornguard profile add <name> | Create a protected connection profile | | thornguard profile update <name> | Update an existing profile | | thornguard profile list | List saved profiles | | thornguard profile show <name> | Show full profile details | | thornguard profile remove <name> | Delete a profile | | thornguard print-config --client <client> <name> | Print or apply MCP config | | thornguard run <name> | Launch the protected connection for a profile | | thornguard bridge <name> | Experimental stdio bridge path | | thornguard scan | Discover MCP servers across supported clients | | thornguard protect | Wrap an existing remote MCP server with ThornGuard | | thornguard doctor <name> | Run connection and config checks | | thornguard status <name> | Show profile details and advisories |

Run thornguard help <command> for full flags and examples.

How It Works

For CLI-managed setups, your editor runs:

Editor -> thornguard run <profile> -> thorns.qwady.app -> upstream MCP server

The CLI handles:

• loading your stored license key
• ensuring the current device activation is valid
• injecting the activation ID and activation proof at runtime
• launching the current mcp-remote transport safely

That means the generated client config can stay focused on thornguard run <profile> instead of embedding raw secrets directly.

Example Workflow

thornguard auth login

thornguard profile add github-protected \
  --target-url https://api.githubcopilot.com/mcp \
  --upstream-auth-mode bearer \
  --vendor-name GitHub \
  --repo-url https://github.com/github/github-mcp-server \
  --status-page-url https://www.githubstatus.com \
  --intel-enabled

thornguard print-config --client vscode github-protected --apply
thornguard doctor github-protected
thornguard status github-protected --refresh

Links

• Product: thorns.qwady.app
• Dashboard: thorns.qwady.io
• Docs: qwady.wiki/thornguard
• CLI Reference: qwady.wiki/thornguard/cli-reference

License

MIT for this package.

Using the hosted ThornGuard service still requires a valid ThornGuard license key / subscription.