MCP Guardrail 🔍

Scan MCP configs for security issues before agents touch prod data.

MCP (Model Context Protocol) lets AI agents touch files, databases, APIs, and internal tools — but teams lack visibility into which MCP servers their developers are running and whether those servers introduce security risks. MCP Guardrail gives you a single command to inventory and audit your MCP configuration.

Quick Start

npx @karthik/mcp-guardrail scan

Or install globally:

npm install -g @karthik/mcp-guardrail
mcp-guardrail scan

Or run from the repo:

node dist/index.js scan

Usage

MCP Guardrail v0.1.0 — Scan MCP configs for security issues

USAGE:
  mcp-guardrail scan [options]

OPTIONS:
  -f, --format <format>  Output format: terminal (default), markdown, json, sarif
  -o, --output <file>    Write output to file instead of stdout
  -c, --config <file>    Scan a specific config file instead of auto-discovery
  -h, --help             Show this help

EXAMPLES:
  mcp-guardrail scan
  mcp-guardrail scan --format json
  mcp-guardrail scan --config ./test-mcp-config.json
  mcp-guardrail scan --format markdown --output report.md

What It Scans

Auto-discovered Configs

| Client | macOS Path | Linux Path | Windows Path | |--------|-----------|-----------|-------------| | Claude Desktop | ~/Library/Application Support/Claude/claude_desktop_config.json | ~/.config/Claude/claude_desktop_config.json | %APPDATA%\Claude\claude_desktop_config.json | | Cursor | ~/.cursor/mcp.json | ~/.cursor/mcp.json | ~/.cursor/mcp.json | | VS Code | ~/.vscode/mcp.json | ~/.vscode/mcp.json | %APPDATA%\Code\User\mcp.json | | Copilot Chat | ~/Library/Application Support/Code/User/globalStorage/github.copilot-chat/mcp.json | (varies) | (varies) |

Security Checks (6 Rules)

| Rule | ID | Severity | What It Detects | |------|-----|----------|-----------------| | Shell execution | MCP-R001 | 🔴 Critical | MCP server launches bash/sh/zsh/powershell | | Dangerous args | MCP-R002 | 🔴 Critical | rm -rf, pipe to shell, command injection patterns | | Remote download | MCP-R003 | 🟡 Warning | curl/wget/fetch as the command | | Secrets in env | MCP-R004 | 🟡 Warning | API keys, tokens, JWTs stored in config env vars | | Unpinned version | MCP-R005 | 🔵 Info | npx/uvx without pinned version | | Non-standard path | MCP-R006 | 🔵 Info | Custom absolute path as command binary |

Output Formats

• terminal (default): Human-readable with emoji indicators
• json: Full structured data for programmatic consumption
• markdown: Clean report ready to attach to tickets or PRs
• sarif: SARIF 2.1 format for CI and security toolchains

Why This Exists

• MCP adoption is accelerating — the TypeScript SDK has ~140M+ npm downloads/month
• Security researchers have documented MCP-specific attack classes (prompt injection, line jumping)
• Existing scanners focus on runtime injection testing, not config-level inventory + policy
• Teams need visibility into what MCP servers their developers run before they can secure them

License

MIT