sainitish1609/mcp-guard

mcp-guard is a small, fast local security tool written in Go that sits between an AI coding assistant, such as Claude Code or Cursor, and any Model Context Protocol server it talks to. Model Context Protocol, or MCP, is a standard way for AI tools to connect to external data sources and actions. mcp-guard runs as a proxy in that connection, inspecting both what goes out to the AI and what comes back, so it can catch problems before they cause harm. The main concern it addresses is that when an AI agent reads files from your computer through an MCP server, such as a filesystem or database server, sensitive information like API keys, passwords, or private paths can end up being sent to a cloud based AI provider in plain text. mcp-guard scans outgoing tool results for over ten common secret formats, including cloud provider keys, database connection strings, and private keys, and replaces them with a redacted marker before they reach the AI. It also blocks the AI from reading or writing to protected paths such as SSH keys, cloud credentials, and git internals, even if the AI tries clever path tricks to get around the restriction. A separate optional feature strips comments and extra whitespace from text before it is sent, to save space in the AI's context window without changing the underlying files. The tool installs as a single Go binary with no other dependencies, so it starts quickly and adds very little delay. It is configured with command line flags that control which protections are turned on, what counts as a protected path, and how much detail gets logged. It is licensed under MIT, so it can be freely used, modified, and redistributed.