GuardMCP
github.com/berkantacun/guardmcp- Category
- Cybersecurity
- Rank
- No. 2124Tools index
Previous survey · No. 2031 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Security & Identity
- Interfaces
- CLI
- GitHub
- 2 stars
- Latest release
- v0.17.0
- Date
About
GuardMCP is a security scanner for MCP (Model Context Protocol) servers and configuration files that checks for hardcoded secrets, tool poisoning, insecure transport, unrestricted permissions, and rug-pull risk. It outputs results as terminal text, JSON, or schema-validated SARIF for direct integration with GitHub Code Scanning, and can also run as a GitHub Action.
At a glance
GuardMCP scans MCP servers and configuration for patterns such as embedded secrets, risky descriptions and insecure transport. It is worth trying if you review new MCP tools or want a repeatable check when a server’s advertised tools change.
Good fit
Developers maintaining MCP configurations who can investigate scanner findings.
Consider something else when
Use a deeper review if you need evidence about everything the server can do at runtime.
Start here
Scan a local fixture with a fake secret and an unsafe tool description. Compare the findings with the intended rules before using live introspection.
Cost and requirements
Apache 2.0. The package requires Node.js 20 or later and documents terminal, JSON and SARIF output.
Limits to know
Static rules and live metadata checks cover different evidence. A clean scan does not establish trust. Review which server the live check will connect to before running it.
Sources checked 2026-11-05. Source-based assessment.
Why it made the leaderboard
As teams wire more MCP servers into their agents, guardmcp catches the specific MCP failure modes, tool poisoning, secret leaks, rug-pulled tool definitions, and insecure transport, that generic security scanners don't check for, and outputs SARIF for CI integration.
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.