MCP Guardian

What is MCP Guardian?

MCP Guardian manages your LLM assistant's access to MCP servers, giving you real-time control over your LLM's activity. It logs all MCP server activity, allows you to approve or deny individual tool call messages in real time, and provides automated safety and privacy scans (coming soon).

How to use MCP Guardian?

Install nix (Linux/macOS) or rustup, nodejs, and yarn (Windows), then clone the repo and run just build-release to produce the mcp-guardian and mcp-guardian-proxy binaries. Use the proxy to intercept and manage MCP server traffic from your LLM host application.

Key features of MCP Guardian

• Message logging – view traces of all LLM MCP server activity
• Real-time message approvals – approve or deny individual tool calls
• Automated message scans – real-time safety and privacy checks (Coming Soon)
• Manage multiple MCP server configurations easily
• Quickly switch between server collections without manual config file editing

Use cases of MCP Guardian

• Monitor and audit every tool call your LLM makes to MCP servers
• Gatekeep sensitive actions by approving or denying tool call messages in real time
• Swap between different sets of MCP servers (e.g., dev vs. production) without reconfiguring your MCP host

FAQ from MCP Guardian

How does MCP Guardian intercept LLM-to-MCP traffic?

It runs a mcp-guardian-proxy that sits between the LLM host and MCP servers, logging and optionally blocking messages based on approval rules.

What are the system requirements?

Linux or macOS (nix-based dev environment) or Windows (requires git with symlink support, rustup, nodejs, yarn, Visual Studio). Rust and Node.js are build dependencies.

Is the automated message scanning feature available now?

No, automated real-time scans for safety and privacy are listed as “Coming Soon” in the README.

How do I build MCP Guardian?

Run just build-release in the repo root after entering the nix dev shell (Linux/macOS) or after installing dependencies (Windows). The binaries mcp-guardian and mcp-guardian-proxy will appear in _build/bin/.

Does MCP Guardian require a cloud service or external API?

No. The README describes a self-hosted, locally built proxy with no mention of any cloud dependency.