mcp-guard 🛡️

The local privacy firewall, prompt-injection shield, secret sanitizer, and token compressor for AI coding agents.

A zero-dependency security proxy for Model Context Protocol (MCP) servers.

mcp-guard is an ultra-fast, zero-dependency Go binary that sits transparently between your editor (Claude Code, Cursor, VS Code, Copilot) and any Model Context Protocol (MCP) server — over stdio or HTTP/SSE.

It ensures your API keys, database credentials, and protected paths (~/.ssh, .env, .git) are never leaked to cloud LLMs, that malicious content cannot hijack your agent, and that autonomous tool execution cannot touch what it shouldn't — all while trimming token spend.

---

💡 Why mcp-guard?

When AI agents run tools like @modelcontextprotocol/server-filesystem or postgres-mcp, they read raw files and query results straight off your machine. Three things go wrong:

1. Secrets leak. A file with AWS keys, JWTs, or DB passwords gets shipped verbatim to a cloud LLM.
2. Agents get hijacked. A file or web page can carry hidden instructions — invisible Unicode or "ignore all previous instructions" — that the model obeys (prompt injection / tool poisoning).
3. Agents overreach. An autonomous agent overwrites ~/.ssh/authorized_keys, pipes curl … | bash, or reads 100 files in a burst.

mcp-guard runs locally and fixes all three without breaking agent execution:

• 🔒 Zero-Trust I/O Inspection — intercepts both requests and responses on every transport.
• ⚡ Zero-Dependency Go Binary — pure standard library, sub-millisecond overhead.
• 🔄 Recoverable Guardrail Errors — returns structured isError: true results so agents self-correct instead of crashing.
• 📊 Visible Value — a session summary shows exactly what it protected and how many tokens/dollars it saved.

---

🎯 Threat Model — what this does and doesn't replace

mcp-guard is defense-in-depth for the agent boundary, not a replacement for good security hygiene. Being precise about that matters more than sounding impressive.

What it addresses

| Risk | How mcp-guard handles it | | --- | --- | | Sensitive data leaving your machine when an agent reads a file or query result | Redacted before it reaches the model | | Instructions injected into content your agent consumes (files, web pages, tool descriptions) | Hidden Unicode stripped, directives neutralized | | An agent writing to paths it was never meant to touch | Blocked, including via ../ traversal and symlinks | | A runaway or compromised agent enumerating your filesystem | Rate-limited, read-bursts flagged | | No record of any of the above | Every action audited to stderr (text or JSON Lines) |

What it explicitly does not replace

• Short-lived credentials. If you can use STS / OIDC federation / SSO, do that first — it is the stronger control. Rotation shrinks the blast radius; mcp-guard reduces the chance of disclosure in the first place. They solve different halves, and the credential fix is the more important one.
• A secrets manager or least-privilege IAM. A key that was never on disk cannot be read off disk.
• Reviewing what your agent actually does. Guardrails constrain the blast radius; they do not make an unreviewed agent trustworthy.

Known limitations — read these before relying on it

• Detection is heuristic. Named-pattern secret matching is high-precision and masks by default; the entropy catch-all is lower-precision (it fires on integrity hashes and base64 fixtures) so it is audit-only by default and only masks when you opt in. Injection detection is signature-based. A novel credential format or a carefully-worded injection will get through — treat it as a layer, not a guarantee.
• It only sees traffic that flows through it. An MCP server that makes its own outbound network calls (a fetch-style server, telemetry, a phone-home) is invisible to mcp-guard. It secures the client↔server channel, not the server's own egress.
• Request-side secret scanning warns, it does not block. Some tools legitimately need credentials in their arguments, so blocking by default would break them.
• Compression can alter text. It is off by default and skips read-for-edit tools, because rewriting a file the agent is about to patch corrupts the diff.
• It does not authenticate the MCP server. A malicious server can still return wrong (if sanitized) answers. Injection defense reduces that risk; it does not eliminate it.

If you find a case where a real secret or injection payload slips through, that is a bug worth opening an issue for — false negatives and false positives are both regressions.

---

🏗️ Architecture

┌─────────────────────────┐          ┌────────────────────────────────────┐          ┌─────────────────────────┐
│                         │  request │             mcp-guard              │  request │                         │
│  Editor / MCP Client    ├─────────►│  ┌──────────────────────────────┐  ├─────────►│       MCP Server        │
│                         │          │  │ →  guardrails · shell block   │  │          │  (filesystem, postgres, │
│  (Claude Code / Cursor  │          │  │    rate-limit · req-secrets   │  │          │   github, http, …)      │
│   / VS Code / Copilot)  │◄─────────┤  │ ←  redact · entropy · inject  │  │◄─────────┤                         │
│                         │ response │  │    defense · compression      │  │ response │                         │
└─────────────────────────┘          │  └──────────────────────────────┘  │          └─────────────────────────┘
                                      │   stdio  ·  HTTP / SSE  ·  audit    │
                                      └────────────────────────────────────┘

---

✨ Features

1. 🔑 Secret & Credential Redaction (Server ➔ Client)

Scans every string in a tool result — including structuredContent mirrors and tool descriptions — for 12+ credential formats before they reach the LLM:

• Cloud & AI keys: AWS (AKIA…), Anthropic, OpenAI, Stripe, Google, Slack, GitHub PATs.
• Database URIs: masks the password in postgres://user:pass@host, mongodb+srv://, redis://:pass@host — even passwords containing @.
• Private keys & JWTs: full-block masking for RSA/PEM keys and Bearer tokens.
• 🆕 High-entropy catch-all (audit-only by default): a Shannon-entropy pass flags unknown-format generated secrets that match no named pattern, using a character-class discriminator to avoid git SHAs, UUIDs, and file paths. Because the heuristic also fires on integrity hashes, base64 fixtures, and signed URLs, it reports by default (logging the detector and byte offsets) and only masks when you opt in with --entropy-mask or --profile strict. This keeps it from silently corrupting otherwise-valid structured data.

# Before mcp-guard:
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
DATABASE_URL=postgres://admin:P@ssw0rd123!@db.internal:5432/prod
SESSION=nQ7wLp4sZa1cFd8gHj0tYuXk9mR2vB3E

# After mcp-guard:
AWS_ACCESS_KEY_ID=[REDACTED:aws-access-key]
DATABASE_URL=postgres://admin:[REDACTED:uri-credentials]@db.internal:5432/prod
SESSION=[REDACTED:high-entropy]   # entropy match — masked under --entropy-mask / --profile strict;
                                  # audit-only (logged, not masked) by default

2. 🧬 Prompt-Injection & Tool-Poisoning Defense 🆕

Content coming back from a server (file bodies, web pages, even a malicious server's own tool descriptions) can carry instructions aimed at your agent. mcp-guard neutralizes both vectors:

• Hidden Unicode — strips invisible "tag" characters (U+E0000 block used to smuggle invisible ASCII), bidirectional-override controls, and zero-width spaces. Legitimate script/emoji joiners are preserved.
• Injection directives — high-signal phrases like "ignore all previous instructions", "do not tell the user", or "reveal your system prompt" are replaced with a visible [mcp-guard: neutralized-injection] marker (or detect-only, your choice).

3. 🛡️ Directory Guardrails & Write Protection (Client ➔ Server)

Blocks agents from modifying protected paths — through relative traversal (../.ssh) and symlink escapes 🆕 (a project/data → ~/.ssh link is resolved and caught):

• Protected directories (anywhere in the path): ~/.ssh, .aws, .gnupg, .kube, .git, .env*
• Sensitive files: id_rsa, id_ed25519, authorized_keys, .npmrc, .netrc, .pypirc, .dockercfg
• Shell-script blocking: refuses *.sh/*.ps1, bash -c, and curl … | sh patterns by default.
• 🆕 Optional sensitive-read blocking: hard-block reads of protected paths (default: allow the read and redact its contents instead).

4. 🚦 Exfiltration & Anomaly Guardrails 🆕

A behavioral layer on top of per-call checks:

• Rate limiting — throttle runaway or compromised agents past a calls-per-minute cap.
• Read-burst detection — warns on a sudden spike of distinct file reads (a classic bulk-exfiltration signature).
• Outbound secret scanning — warns when a tool call's arguments carry secret-shaped data, so a key the agent just read can't silently be forwarded to a phone-home server unnoticed.

5. ⚡ Context Token Compression (Opt-In)

Strips redundant comments and whitespace to save context-window capacity, with a code-aware token estimator for accurate accounting.

Compression automatically skips read-for-edit tools (read_file, get_file_contents) to preserve exact diff boundaries for safe file editing.

6. 📊 Session Summary & Structured Audit 🆕

• On exit (and on SIGUSR1) mcp-guard prints a summary: secrets redacted by type, writes/reads/shell blocked, injections neutralized, tokens saved, and an estimated $ saved.
• All activity streams to stderr as human text or JSON Lines (--log-format json) for SIEM ingestion. stdout carries only the MCP protocol.

mcp-guard session summary
  secrets redacted       4
      aws-access-key     1
      uri-credentials    1
      high-entropy       2
  writes blocked         1
  injections neutralized 3
  tokens saved           1840
  est. cost saved        $0.0055

7. 🎛️ Policy Profiles & Hot Reload 🆕

• Profiles apply per-server strictness in one flag: --profile strict|standard|permissive (e.g. lock down a shell server, relax a read-only docs server).
• Hot reload — send SIGHUP to re-read the config and swap policy live, without dropping the agent connection.

---

🚀 Installation

Prebuilt binary (no Go toolchain required) — grab it from the latest release:

# macOS (Apple Silicon) — swap darwin_arm64 for your platform
curl -sSL https://github.com/sainitish1609/mcp-guard/releases/latest/download/mcp-guard_darwin_arm64.tar.gz | tar xz
sudo mv mcp-guard /usr/local/bin/

With Go:

go install github.com/sainitish1609/mcp-guard/cmd/mcp-guard@latest

From source:

git clone https://github.com/sainitish1609/mcp-guard.git
cd mcp-guard
go build -o mcp-guard ./cmd/mcp-guard

Builds for macOS, Linux, and Windows (amd64 + arm64). Eve