hlido-mcp-guard

Check an MCP server's independent trust verdict before it starts. A zero‑dependency, no‑API‑key runtime guardrail for Claude Code, Cursor, Cline, Windsurf, and any stdio MCP client — powered by Hlido's public, evidence‑backed MCP register.

You wouldn't curl | sh a script you've never seen. Adding an MCP server to your agent is the same trust decision — it runs with your agent's tools and data. hlido-mcp-guard makes that check a reflex: it resolves the server against Hlido's independent register, and refuses to start the ones flagged dangerous or tool‑poisoning.

Quick start

Wrap any MCP server command with the guard in your client config:

// Claude Code / Cursor / Cline  (.mcp.json, mcp.json, cline_mcp_settings.json)
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "hlido-mcp-guard", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/path"]
    }
  }
}

That's it. On startup the guard prints the server's Hlido verdict, blocks it if it crosses your threshold, and otherwise transparently passes through — your agent talks to the real server exactly as before.

Pre‑flight a server without adding it (CI‑friendly, exits non‑zero if it would block):

npx hlido-mcp-guard --check -- npx -y @modelcontextprotocol/server-filesystem /tmp

What it does

• Resolves the wrapped command against the public register at https://hlido.eu/data/mcp-register.json (matches the npm / PyPI / URL install spec — no credentials, the data is public).
• Prints the verdict: ✓ SAFE · △ CAUTION · ⚠️ RISKY · ⛔ DANGEROUS · ⛔ POISONING · ? UNREVIEWED, with the security score and a link to the evidence.
• Blocks servers at/over your --fail-on threshold; tool‑poisoning always blocks.
• On allow, exec‑passes‑through with full stdio — zero behavior change for the agent.
• Fails open: if Hlido is unreachable, your server still starts (a trust check never becomes an outage).

Options

| Flag | Default | Meaning | |---|---|---| | --fail-on <tier> | dangerous | Block threshold: poisoning | dangerous | risky | caution. Poisoning always blocks. | | --warn-only | off | Never block — print the verdict and always run (audit mode). | | --strict | off | Also block servers Hlido hasn't reviewed yet (default: warn + allow). | | --check | off | Evaluate + print, don't spawn (exit 0 = allow, 3 = block). Use in CI. | | --json | off | Machine‑readable verdict on stderr. |

Why

The install/first‑use moment is where the trust decision actually happens, and today it happens blind. hlido-mcp-guard puts an independent verdict right in that path — no vendor pays Hlido for a score, the scoring is evidence‑backed, and the register is public and machine‑readable. Unreviewed server? The guard tells you, and you can submit it free at hlido.eu/mcp.

License

MIT · Hlido · independent, evidence‑backed AI‑agent & MCP reviews.