mcp-guardian (rudraneel93/mcp-guardian) is an MCP server listed on the M8ven Trust Index. It scores 0 out of 100, grade F. It declares 62 tools. No publisher has claimed this listing.

Warning

0/100

mcp-guardian

Item: mcp-guardian
Rating: 0
Author: M8ven

Security, cost, and health governance proxy for MCP infrastructure. Enforces YAML-configurable security policies (blocklists, rate limits, token budgets), tracks real token costs via tiktoken, monitors server health with live JSON-RPC probes. Features OAuth 2.1/OIDC with RBAC, web dashboard, payload normalization, semantic shell AST analysis, mTLS, and a formal STRIDE threat model.

→ rudraneel93/mcp-guardian · listed on glama

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

rudraneel93

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Secret credentials may flow to a network call

2 flows detected: CONTROL_PLANE_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🚨

Code appears obfuscated

2 files are unreadable to a human reviewer. Cannot audit what they do.

🚨

Known vulnerabilities in dependencies: 1 critical, 15 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 2 credentials: GUARDIAN_INTERNAL_ADMIN_TOKEN, GUARDIAN_LICENSE_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes62 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

scan_security

Scan MCP server configurations for security vulnerabilities (CVEs, auth, typo-squatting, secrets)

audit_costs

Audit token usage and estimate costs per MCP server

check_health

Check health, latency, and reliability of MCP servers

full_report

Generate a complete security, cost, and health report for all MCP servers

start_behavior_observation

Start observing AI agent tool calls to learn usage patterns for policy generation

stop_behavior_observation

Stop the current observation window and finalize collected data

generate_policy_from_observations

Generate a minimal-privilege YAML policy based on observed tool call patterns

suggest_policy_improvements

Compare observed behavior against current policy and suggest additions/removals

observation_status

Get current behavior observation status and summary

scan_prompt_injection

Scan tool call arguments for prompt injection payloads targeting downstream AI agents

prompt_injection_report

Get prompt injection detection statistics

predict_threats

Generate threat forecast for all configured MCP servers with 30/90/365-day projections

threat_forecast_for_server

Detailed threat forecast for a specific server with risk factors and preemptive hardening recommendations

preemptive_recommendations

Get suggested preemptive policy changes based on threat forecasts

verify_supply_chain

Full supply chain integrity verification with signed attestation for MCP server packages

supply_chain_status

Current trust graph state for all MCP server packages

sbom_export

Export Software Bill of Materials for MCP server packages

detect_drift

Compare current MCP server behavior against a known-good baseline to detect anomalies

capture_baseline

Capture current server state as a known-good behavioral baseline

rollback_server_config

Revert to a previous known-good configuration snapshot

drift_history

List all detected drift events

generate_compliance_evidence

Generate auditor-ready compliance evidence bundle for a framework

compliance_gap_analysis

Identify missing compliance controls and recommend policies

compliance_posture

Get current compliance posture score across all frameworks

list_compliance_frameworks

List all supported compliance frameworks

run_self_assessment

Run a full autonomous red team assessment with attack generation and policy testing

schedule_red_team

Configure periodic autonomous red team assessments

red_team_results

Get latest red team assessment results and recommendations

ab_test_policy

A/B test a proposed policy change against historical attack corpus

contribute_threat_signature

Submit an anonymized threat signature to the cross-deployment intelligence mesh

threat_intel_status

Get mesh connectivity, contribution stats, and known threat feed

deploy_honeypot

Deploy an ephemeral fake MCP server to detect adversarial probing

honeypot_report

Get attack patterns observed by all active honeypots

destroy_honeypot

Tear down a specific honeypot and retrieve captured data

list_honeypots

List all active and destroyed honeypots with summary

negotiate_agent_trust

Initiate an automated trust handshake with another AI agent behind Guardian

agent_trust_status

View all active trust relationships and session details

revoke_agent_trust

Immediately terminate a trust relationship

trust_registry_list

List all registered agents in the trust registry

agentic_status

Get overall status of all agentic AI features including metrics, scheduler, and task queue

compute_trust_score

Compute an A+-F trust score for an MCP server across 8 security dimensions (like SSL Labs for MCP)

scan_response_dlp

Scan MCP tool responses for PII, credentials, sensitive paths, and data exfiltration

certify_server

Run MCP server certification (Bronze/Silver/Gold/Platinum)

list_certified_servers

List MCP servers in the local certification registry with level and expiry

verify_certification

Verify a server certification attestation (JWS) and level

declare_intent

Declare session intent and allowed tools for intent-binding enforcement

run_protocol_fuzzer

Run MCP protocol fuzzer — test defenses against malformed JSON-RPC, overflow, injection

check_sla

Check SLA compliance — p50/p95 latency, error rate, circuit breaker state per tool

run_incident_playbook

Execute an incident response playbook (prompt_injection, credential_leak, shell_injection)

get_agent_reputation

Get agent reputation score — Trusted/Standard/Suspicious/Blocked tier with bypass rate and entropy

harden_config

Analyze MCP server config and get A-F hardening grade with one-click recommendations

detect_collusion

Detect agent-to-agent collusion patterns (recon-then-exploit, coordinated exfil, token sharing)

policy_to_natural_language

Explain MCP Guardian policy YAML in plain English for compliance stakeholders

natural_language_to_policy

Convert a natural-language security goal into a draft YAML policy rule (requires approval before enforce)

query_server_reputation

Query decentralized MCP server reputation (8-dimension consensus score)

quantify_insurance_risk

Compute cyber insurance ALE (Annualized Loss Expectancy) for an MCP server

sample_agent_trust

Thompson Sampling — run Bayesian bandit trust sampling for an agent (Beta posterior, exploration/exploitation)

tune_policy_rule

Contextual Bandit (LinUCB) — select optimal policy action (enforce/relax/skip) based on context

adapt_threshold

SARSA — adaptively tune rate limit, latency limit, or confidence threshold via reinforcement learning

select_fuzz_strategy

REINFORCE — use policy gradient to select optimal fuzzer mutation strategy

echo

Echo arguments back

search

Search (harness probe)

// known CVEs in dependencies1 critical15 high5 medium10 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.2.4GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.25.2GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

highaxios@1.7.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.0GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.7.0GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configCONTROL_PLANE_POLICY_PATH

configCONTROL_PLANE_PORT

configCONTROL_PLANE_RULES_CACHE_MS

configCORPUS_MIN_ATTACK_SAMPLES

configCORPUS_MIN_F1

configDASHBOARD_ALLOWED_ORIGINS

configDASHBOARD_AUTH_DISABLEDtrue in dev script

configDASHBOARD_ENABLEDtrue when using mcp-guardian start or dashboard:proxy

configDASHBOARD_PORT4000

configGUARDIAN_AI_DISABLE_THREAT_POLL

configGUARDIAN_AI_ENABLED

configGUARDIAN_AI_INSTANT_LEARNING

configGUARDIAN_ANOMALY_BLOCK

configGUARDIAN_AUDIT_SYNC_ENABLED

configGUARDIAN_AUTO_CORPUS_PROMOTE

configGUARDIAN_BENCH_RUN_HARNESS

configGUARDIAN_CI_BYPASS_LICENSELocal development can use =true with pnpm dashboard:proxy. Production Pro needs a license — [PRO_SETUP.md](docs/PRO_SETUP.md).

configGUARDIAN_CONTROL_PLANE_URL

configGUARDIAN_DAILY_BUDGET_USDDaily spend alert threshold

configGUARDIAN_DASHBOARD_API_RATE_LIMIT

configGUARDIAN_DASHBOARD_SPA

configGUARDIAN_DISABLE_SEMANTIC

configGUARDIAN_FEDERATED_LEARNING_MIN_REPORTS

configGUARDIAN_FUZZ_TARGET

configGUARDIAN_GATEWAY_MODE

configGUARDIAN_HEALTH_PROBE_TIMEOUT_MS

configGUARDIAN_HEALTH_REPORT_LLM

configGUARDIAN_INSIGHTS_LLM

🔐 secretGUARDIAN_INTERNAL_ADMIN_TOKEN

🔐 secretGUARDIAN_LICENSE_KEY

configGUARDIAN_POLICY_MODE

configGUARDIAN_POLICY_PATH

configGUARDIAN_POLICY_SIGNING_EXPIRES_AT

configGUARDIAN_POLICY_SIGNING_ISSUER

configGUARDIAN_POLICY_SIGNING_KEY_ID

configGUARDIAN_POLICY_SYNC_ENABLED

configGUARDIAN_POLICY_TIMING_ENVELOPE

configGUARDIAN_REGION

configGUARDIAN_REQUEST_TIMEOUT_MS

configGUARDIAN_SEMANTIC_ASYNC

configGUARDIAN_SEMANTIC_STORE_CALIBRATION

configGUARDIAN_SOAR_PLAYBOOKS

configGUARDIAN_SSE_PROXY_PORT

configGUARDIAN_STICKY_SESSION_AUTH

configGUARDIAN_STREAMABLE_HTTP_UPSTREAM_RELAY

configGUARDIAN_SWARM_SKIP_CONTINUOUS

configGUARDIAN_TENANT_ID

configGUARDIAN_TOOL_TIMEOUT_JSON

configGUARDIAN_WS_ENABLEDtrue

configGUARDIAN_WS_PUSH_INTERVAL_MS

configLIVE_ATTACK_BENIGN_RATIO

configLIVE_ATTACK_DURATION_MINUTES

configLIVE_ATTACK_ESCALATION

configLIVE_ATTACK_INTERVAL_MS

configMCP_FS_ROOT

configMCP_GUARDIAN_COST_BUDGET

configMCP_GUARDIAN_DB_PATHThe dashboard is not a separate database — it reads the same call_records the proxy writes. Set consistently when running pnpm real-life:filesystem or other tests so charts match proxy traffic.

configMCP_GUARDIAN_HOME

configMCP_GUARDIAN_MODE

configMCP_GUARDIAN_POLICYPath to your rules file

configMCP_GUARDIAN_POLICY_PATH

configMETRICS_PORT

configNO_COLOR

configREAL_LIFE_BURST_REPEATS

configREAL_LIFE_FILESYSTEM_MCP_ENTRY

configREAL_LIFE_METRICS_ENABLED

configREAL_LIFE_POLICY_PATH

configREAL_LIFE_PROXY_READY_MS

configREAL_LIFE_SEMANTIC_DRAIN_MS

configREAL_LIFE_UPSTREAM_READY_MS

configREPLICA_COUNT

configSOC_API_PORT

configSOC_API_REFRESH_INTERVAL_MS

configSTUB_ROLE

configSWARM_CALIBRATE_AUTO_LABEL

configSWARM_CALIBRATE_CAPTURE

configTSX_DISABLE_IPC

configGUARDIAN_ENCODING_GUARD

configMCP_GUARDIAN_MAX_POLICY_ARGS_BYTES

configMCP_GUARDIAN_MAX_JSON_DEPTH

configGUARDIAN_GITHUB_ALLOWED_REPOS

configGUARDIAN_THREAT_STATE_PATH

configGUARDIAN_DISABLE_THREAT_INTEL_GUARD

configMCP_GUARDIAN_MAX_TIMING_PROBES_PER_MIN

configMCP_GUARDIAN_MAX_ENUM_PROBES_PER_SESSION

configGUARDIAN_TIMING_GUARD

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployDATABASE_URL

deployPORT

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

62/62 tools missing one or more hints — scan_security (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); audit_costs (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); check_health (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +59 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 2/62 tools referenced in tests (3%)

Write tests that reference each tool by name so every tool has at least one test.

Readable source code

2 files appear obfuscated, including code that decodes and evaluates itself at runtime

Ship unminified, readable source.

Production dependencies are patched

0 critical, 15 high severity in production deps — @modelcontextprotocol/sdk@1.25.2 (high), axios@1.7.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Dependency freshness

3/28 production deps abandoned (no release in 2+ years): bash-parser@2022-06-13 (4.2y), proper-lockfile@2022-06-24 (4.2y), webhook-discord@2022-06-28 (4.2y)

Domain consistency

npm scope @mcp-guardian doesn't match GitHub owner rudraneel93

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/rudraneel93/mcp-guardian?variant=verified)](https://m8ven.ai/mcp/rudraneel93/mcp-guardian)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 56b1c515eb378d058315652b005c587fc4144029

code hash: 0c5346a9295d3c0887db1f660749baff6512622795eec45f25d526beb458f6ba

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client