ianewsfr-a11y/mcp-guard

Review signals: 1 hardcoded secret, 2 known vulnerability. 18 static matches retained as context.

Gitleaks found a possible hardcoded secret; value withheld. config_example.json

OSV reports a known vulnerability in this dependency version. pydantic 2 findings.

18 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Offline by default: audits a config without starting servers: Real input produced the expected result: execute_bash_command

  Source: By default it runs entirely offline and never executes the servers it audits.

  Input: config_example.json

  Expected: JSON audit listing execute_bash_command

  Command: <guest-path> inspect config_example.json --format json

  Observed: execute_bash_command", "server": null, "risk": "CRITICAL", "findings": [ { "id": "fad9054d64b5abca4b3d8419ac2ec834", "category": "command-execution", "risk": "CRITICAL", "evidence": "bash, execute, shell" }, { "id": "6994492e89d4c3a5716087bc51558440", "category": "privileged-access", "risk": "CRITICAL", "evidence": "root" } ] }, { "kind": "tool", "name": "update_customer_record", "server": null, "risk": "HIGH", "findings": [ { "id": "0773e4a328e89cfd104d

• --live starts the server and audits its real tools (memory server quick start): Real input produced the expected result: delete_entities

  Source: mcp-guard starts the server once, performs the MCP handshake, reads the tools it really exposes and audits each one:

  Input: npx -y @modelcontextprotocol/server-memory

  Expected: JSON audit listing the real delete_entities tool

  Command: <guest-path> inspect --live --yes --server 'npx -y @modelcontextprotocol/server-memory' --format json

  Observed: delete_entities", "server": "server-memory", "risk": "HIGH", "findings": [ { "id": "15bbe97fbbcc2c91b67f5876a704eec9", "category": "write-operation", "risk": "HIGH", "evidence": "delete" } ] }, { "kind": "tool", "name": "delete_observations", "server": "server-memory", "risk": "HIGH", "findings": [ { "id": "2ab73595feb0ebea35c99155b8995d06", "category": "write-operation", "risk": "HIGH", "evidence": "delete" } ] }, { "kind": "tool", "name": "delete_rel

• inspect flags hidden instructions as tool poisoning: Real input produced the expected result: TOOL POISONING DETECTED

  Source: prints a **TOOL POISONING DETECTED** alert under the table

  Input: examples/poisoned_tools.json

  Expected: TOOL POISONING DETECTED alert

  Command: <guest-path> inspect examples/poisoned_tools.json

  Observed: TOOL POISONING DETECTED ───────────────────────────╮ │ 4 tool(s) carry hidden instructions for the model: get_weather, add_numbers, │ │ translate_text, format_date. │ │ Any agent connected to this server reads them as if they came from you. Do │ │ not enable these tools until their descriptions and parameter descriptions │ │ have been reviewed. │ ╰──────────────────────────────────────────────────────────────────────────────╯

Examples

• Tool poisoning detection on the shipped sample: command completed successfully

  Source: README.md Tool poisoning section (examples/poisoned_tools.json)

  Input: examples/poisoned_tools.json

  Expected: TOOL POISONING DETECTED alert

  Command: <guest-path> inspect examples/poisoned_tools.json

  Observed: 0 HIGH 4 MEDIUM 0 LOW 1 ╭────────────────────────── TOOL POISONING DETECTED ───────────────────────────╮ │ 4 tool(s) carry hidden instructions for the model: get_weather, add_numbers, │ │ translate_text, format_date. │ │ Any agent connected to this server reads them as if they came from you. Do │ │ not enable these tools until their descriptions and parameter descriptions │ │ have been reviewed. │ ╰──────────────────────────────────────────────────────────────────────────────╯

• Custom rules file (--rules) applied to a config: command completed successfully

  Source: README.md --rules: custom rules (examples/rules.yaml)

  Input: examples/rules.yaml with config_example.json

  Expected: JSON audit with privileged-access finding

  Command: <guest-path> inspect --rules examples/rules.yaml config_example.json --format json

  Observed: "update" }, { "id": "1b25a8ab4e22246c65c777ebbfa39be8", "category": "database", "risk": "MEDIUM", "evidence": "database, query, sql, table" }, { "id": "e5efd8045e9a7c12789b1a68b6cdf766", "category": "customer-data", "risk": "HIGH", "evidence": "customer, customers" } ] }, { "kind": "server", "name": "filesystem", "server": null, "risk": "LOW", "findings": [] }, { "kind": "tool", "name": "fetch_url", "server": null, "risk": "LOW", "findings": [] } ]

• Documented test suite: Ran the documented command with the venv pytest: 945 passed, 1 failed (tests/test_proxy.py::test_pins_never_store_secrets_or_the_home_directory). The failure is environmental: the test expects the venv python under the home directory, but the venv is at <guest-path> and resolves to /usr/bin/python3.12. Not a product defect as far as observed.

  Source: README.md Development section (pytest --cov=mcp_guard)

  Expected: documented command completes successfully

  Observed: Ran the documented command with the venv pytest: 945 passed, 1 failed (tests/test_proxy.py::test_pins_never_store_secrets_or_the_home_directory). The failure is environmental: the test expects the venv python under the home directory, but the venv is at <guest-path> and resolves to /usr/bin/python3.12. Not a product defect as far as observed.

Local or hosted: local

Audit MCP server configs and live servers with mcp-guard (static audit of config_example.json, live tools/list of the official memory server, tool-poisoning detection on examples/poisoned_tools.json)

cd <guest-path> && ls -la && git status 2>&1 | head -3; id -u; cat /etc/os-release | head -2; python3 --version; cat README.md 2>/dev/null | head -200
cd <guest-path> && sed -n 200,400p README.md; ls .coldpass; cat CLAUDE.md | head -50; cat requirements.txt requirements-dev.txt; grep -n requires-python pyproject.toml
cd <guest-path> && grep -n '^#' README.md; grep -n -i 'cron\|schedul\|--once\|webhook\|loop' README.md | head; sed -n 400,520p README.md | cut -c1-300
cd <guest-path> && sed -n 520,570p README.md | cut -c1-400; sed -n 1,60p pyproject.toml; ls .github/workflows examples docs tests; cat .gitignore
cd /tmp && (python3 -m venv <guest-path> 2>&1 || (sudo -n apt-get update -qq && sudo -n apt-get install -y -qq python3-venv >/dev/null 2>&1 && python3 -m venv <guest-path>)) ; <guest-path> --version && cd <guest-path> && <guest-path> install -q -e ".[dev]" 2>&1 | tail -5; echo rc=$?; <guest-path> --version
cd <guest-path> && <guest-path> show mcp-guard-audit | head -2; <guest-path> -m pytest -q --cov=mcp_guard --cov-report=term 2>&1 | tail -15; ls -la <guest-path> | grep -i -E 'egg|coverage|pytest'
cd <guest-path> && <guest-path> -m pytest -q tests/test_proxy.py::test_pins_never_store_secrets_or_the_home_directory 2>&1 | grep -E 'Error|assert|E   ' | head -20
cd <guest-path> && M=<guest-path>; $M inspect --help | head -40; which node npx; node --version 2>&1; cat config_example.json | head -30; ls .coldpass
cd <guest-path> && (sudo -n apt-get install -y -qq nodejs npm ><guest-path> 2>&1; echo apt_rc=$?); node --version; npm --version; M=<guest-path>; $M inspect config_example.json; echo rc=$?
cd /tmp && export NODE_USE_ENV_PROXY=1 && timeout 240 <guest-path> inspect --live --yes --server "npx -y @modelcontextprotocol/server-memory" --format json 2><guest-path> | head -c 3000; echo; echo rc=${PIPESTATUS[0]}; tail -5 <guest-path>
cd <guest-path> && M=<guest-path>; $M inspect examples/poisoned_tools.json | tail -8; echo rc=$?; $M inspect --rules examples/rules.yaml config_example.json --format json | head -c 400; echo; echo ---; grep -rn -i 'schedul\|cron\|interval\|while True\|--once\|--now\|webhook' mcp_guard | head -20; ls <guest-path> /inputs 2>&1
cd <guest-path> && M=<guest-path> && cat > .coldpass/probe.json <<EOF
{"kind":"cli","argv":["$M","inspect","config_example.json","--format","json"],"cwd":"<guest-path>","expected_text":"execute_bash_command"}
EOF
cat > .coldpass/claims.json <<EOF
[
{"kind":"claim","claim":"Offline by default: audits a config without starting servers","source":"By default it runs entirely offline and never executes the servers it audits.","input":"config_example.json","expected":"JSON audit listing execute_bash_command","probe_kind":"cli","argv":["$M","inspect","config_example.json","--format","json"],"expected_text":"execute_bash_command","cwd":"<guest-path>"},
{"kind":"claim","claim":"--live starts the server and audits its real tools (memory server quick start)","source":"mcp-guard starts the server once, performs the MCP handshake, reads the tools it really exposes and audits each one:","input":"npx -y @modelcontextprotocol/server-memory","expected":"JSON audit listing the real delete_entities tool","probe_kind":"cli","argv":["$M","inspect","--live","--yes","--server","npx -y @modelcontextprotocol/server-memory","--format","json"],"expected_text":"delete_entities","cwd":"/tmp"},
{"kind":"claim","claim":"inspect flags hidden instructions as tool poisoning","source":"prints a **TOOL POISONING DETECTED** alert under the table","input":"examples/poisoned_tools.json","expected":"TOOL POISONING DETECTED alert","probe_kind":"cli","argv":["$M","inspect","examples/poisoned_tools.json"],"expected_text":"TOOL POISONING DETECTED","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/examples.json <<EOF
[
{"kind":"example","claim":"Tool poisoning detection on the shipped sample","source":"README.md Tool poisoning section (examples/poisoned_tools.json)","input":"examples/poisoned_tools.json","expected":"TOOL POISONING DETECTED alert","argv":["$M","inspect","examples/poisoned_tools.json"],"cwd":"<guest-path>","env":{},"expected_text":"TOOL POISONING DETECTED"},
{"kind":"example","claim":"Custom rules file (--rules) applied to a config","source":"README.md --rules: custom rules (examples/rules.yaml)","input":"examples/rules.yaml with config_example.json","expected":"JSON audit with privileged-access finding","argv":["$M","inspect","--rules","examples/rules.yaml","config_example.json","--format","json"],"cwd":"<guest-path>","env":{},"expected_text":"privileged-access"},
{"kind":"example","claim":"Documented test suite","source":"README.md Development section (pytest --cov=mcp_guard)","reason":"Ran the documented command with the venv pytest: 945 passed, 1 failed (tests/test_proxy.py::test_pins_never_store_secrets_or_the_home_directory). The failure is environmental: the test expects the venv python under the home directory, but the venv is at <guest-path> and resolves to /usr/bin/python3.12. Not a product defect as far as observed."}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README (no cron, schedule, --once or --now, webhook or loop features) and mcp_guard source. The only loops are stdio/proxy message pumps (mcp_guard/live/*, runtime/proxy.py, runtime/journal.py, runtime/recorder.py, runtime/inspector.py), which serve one request stream and are not product cycles. mcp-guard runs one audit per invocation.","checks":[]}
EOF
for f in probe claims examples cycles; do <guest-path> -I -m json.tool .coldpass/$f.json >/dev/null && echo "$f ok"; done; cat .coldpass/probe.json
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo rc=${PIPESTATUS[0]}
cd <guest-path> && rm -rf .coverage .pytest_cache && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Audit MCP server configs and live servers with mcp-guard (static audit of config_example.json, live tools/list of the official memory server, tool-poisoning detection on examples/poisoned_tools.json)","operation_scope":"Linux x86_64 Ubuntu 24.04, Python 3.12.3 venv at <guest-path>, Node v18.19.1 / npm 9.2.0 (apt). Offline audit needs no network; the --live memory-server check needs npm registry access. No credentials or browser needed.","steps":["sudo apt-get install -y python3-venv (after python3 -m venv failed on missing ensurepip)","python3 -m venv <guest-path>","<guest-path> install -e \".[dev]\" (README Development section)","<guest-path> --version -> mcp-guard, version 0.12.0","sudo apt-get install -y nodejs npm (Node needed for npx in README Quick Replication)","<guest-path> inspect config_example.json","NODE_USE_ENV_PROXY=1 <guest-path> inspect --live --yes --server \"npx -y @modelcontextprotocol/server-memory\" --format json (run from /tmp)","<guest-path> inspect examples/poisoned_tools.json","<guest-path> inspect --rules examples/rules.yaml config_example.json --format json","<guest-path> -m pytest --cov=mcp_guard --cov-report=term-missing (README Development)"],"deviations":["python3 -m venv failed: ensurepip not available (Ubuntu python3-venv package missing). Installed python3-venv with sudo apt-get and recreated the venv.","Node/npm were not installed in the guest; installed nodejs and npm from apt (v18.19.1) with sudo so the README's npx quick start could run.","README Development pytest run: 945 passed, 1 failed. tests/test_proxy.py::test_pins_never_store_secrets_or_the_home_directory expects the venv python path to start with ~, but the venv is at <guest-path> and Python resolves to /usr/bin/python3.12. Environmental, recorded as a reasoned example rather than a pass.","The README's pipx/uvx install path was not used; the Development-section editable install (pip install -e .[dev]) was used instead, as the README documents it.","The task's /inputs/coldpass-preflight.py path does not exist in this VM; the checker at <guest-path> was run with --validate --replay instead.","MCP probe not used: mcp-guard is a CLI and does not serve MCP; the probe and claims are kind cli.","Cycle: none detected (no scheduler, cron, --once or webhook). The while-loops in the source are stdio/proxy pumps."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the product. Optional: make the test_proxy home-directory assertion independent of where the venv lives (or run the suite from a venv under $HOME)."}
EOF
<guest-path> -I -m json.tool .coldpass/report.json >/dev/null && echo report ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 300; echo; ls -la .coldpass