petrovicistefan/mcp-security-guard

A Claude Code plugin that audits the **MCP servers you have installed**. Your code is covered by other tools. This one checks the servers that inject text into Claude's context.
Try it in one minute
Requires Node.js 20+. Clone the repository and run a synthetic offline comparison; no account, API key, dependency installation, or MCP server launch is needed.
The demo checks two saved tool descriptions: one produces an instruction-override and sensitive-path finding; the clean counterpart produces no findings. Run the scans yourself and generate an HTML report.
Help improve detection and compatibility
A useful first contribution can be a small JSON/TypeScript sample, not a new feature. Help reduce false positives, add synthetic detection cases, test client configurations, or improve an example.
Contribution guide · Open tasks · Report a false positive
| Check | What it catches |
|---|---|
| Tool poisoning | Instruction overrides, "don't tell the user", tags, directives to read secrets (~/.ssh, .env), conversation harvesting, exfiltration via URLs, parameters and Markdown images, HTML comments, encoded payloads |
| Full-schema poisoning | The same checks on parameter names, descriptions, defaults, enums, required, plus non-schema text in type |
| Hidden text | Zero-width, bidi-control and Unicode-tag characters, ANSI terminal escapes, homoglyph tool names |
| Tool shadowing | A server whose descriptions reference another server's tools, and tool-name collisions between servers |
| Rug pulls | Tool definitions or launch commands that changed after you pinned them (SHA-256 per tool), and skills, commands, subagents, CLAUDE.md and hooks of a plugin or repository that changed after you pinned them (a plugin that changes files under the same version is flagged high). Re-checked automatically at every session start |
| Capabilities & score | Per-tool classification (execute, delete, write, egress), unauthenticated remote write access, 0–100 score and A–F grade per server, recommended permission rules |
| Supply chain | OSV vulnerabilities and malicious versions, typosquats, missing or brand-new packages, install scripts, publisher changes (opt-in network check) |
| Runtime | Hooks on every MCP call: ask before credentials are sent, warn on injected instructions or credentials in outputs, content-free audit log |
| Policy | .mcp-security.json approved/blocked servers and hosts, enforced in audits, CI and at session start |
| Toxic flows | Servers that hold all three legs of the "lethal trifecta" (untrusted input, private data, a way to send data out), on their own or together, with the tools to put behind approval. A posture note (low or info), not a defect |
| Agent context | The text Claude reads besides MCP tools: skills and their scripts, slash commands, subagents, rules, CLAUDE.md and plugin hooks. Instruction overrides, "don't tell the user", invisible text, HTML comments addressed to the model, directives to read credential files, commands that upload credentials, download-and-run, encoded execution, infostealer scripts, pre-approved unrestricted Bash |
| Configuration | Plaintext secrets in env/headers/args/URLs, plain-HTTP remotes, unpinned npx/uvx packages, privileged or unpinned Docker images, pipe-to-shell launches, duplicate names across scopes |
It discovers servers from every place Claude Code and Claude Desktop load them: user, local and project scope, **servers shipped inside installed plugins and plugins synced from your claude.ai account** (named : ), claude_desktop_config.json and **Claude Desktop extensions**, the organisation-managed managed-mcp.json, other clients on the machine (**Cursor, VS Code, Windsurf**, user and project configs), and the **claude.ai connectors** you have used (names only: their configuration lives in your account).
It scans everything a server puts into Claude's context, not only tools: **server instructions, prompts, resources and resource templates** go through the same poisoning checks and are pinned for rug-pull detection.
Everything runs locally. Nothing is sent anywhere.
OWASP MCP Top 10 coverage
Every finding is tagged with its OWASP MCP Top 10 id, in reports and in SARIF.