AI & Technical Systems·Evidence-first review for MCP implementations

MCP Guard

MCP Guard is a scoped defensive review tool for inspecting selected MCP implementation risks and capability changes before a server is trusted.

Status

Public developer release · v0.2.1

Capabilities

AI security · Static analysis · Release discipline

View GitHub ↗

The problem

An MCP server can expose powerful tools while hiding important implementation details behind a small interface. A useful review needs to show concrete evidence, identify supported analysis, and make unsupported coverage visible.

What I worked on

The project combines source rules, offline inventory and schema validation, capability snapshots, drift detection, machine-readable output, and HTML reports. It also includes a constrained macOS discovery path for a reviewed fixture.

Decisions and tradeoffs

Make incomplete coverage visible

An unsupported registration shape returns an incomplete assessment instead of being treated as clean.

Separate source findings from runtime discovery

Static analysis and isolated discovery have different evidence. The tool keeps those boundaries explicit.

Treat capability drift as a review event

Changes to tool descriptions and schemas are surfaced for review even when no source-rule finding crosses the configured threshold.

Evidence and scope

This is a defensive auditor for a documented subset of JavaScript and TypeScript. It is not a runtime firewall, a security certification, or proof that a target is safe.

What this shows

Public shipping, security-oriented product judgment, explicit evidence boundaries, and the discipline to report uncertainty instead of hiding it.