ThornGuard
Put a security gateway in front of remote MCP traffic so auth, PII redaction, policies, and audit logs apply before tools hit production systems.
Overview
ThornGuard is a MCP server for the Ship phase that acts as a remote security gateway for MCP with auth, redaction, policy enforcement, and audit logging.
What is this MCP server?
- Remote MCP security gateway: authentication in front of tool calls
- Automatic redaction and policy enforcement on MCP traffic
- Audit logging for compliance and incident review
- Documented quickstart at qwady.wiki/thornguard
- Version 0.1.0 with official MCP server schema metadata
What problem does it solve?
Connecting agents to powerful MCP tools without a gateway means one prompt can exfiltrate secrets or call disallowed endpoints with no durable audit trail.
Who is it for?
Builders exposing multiple remote MCP tools to teammates or customers who need redaction, policy gates, and centralized auth.
Skip if: Solo devs running a single local MCP server on a laptop with no shared access or compliance obligations.
What do I get? / Deliverables
MCP requests pass through enforced policies and logged reviews before they reach your production integrations.
- Authenticated MCP traffic through the ThornGuard gateway
- Policy-enforced tool calls with audit log records for review
Recommended MCP Servers
Journey fit
Shipping agent tooling to users without a control plane for MCP calls is where data leaks and policy violations surface—ThornGuard belongs on the security shelf before wide rollout. Security subphase covers gateways, authZ, and secret handling for integrations your agent can invoke in production.
How it compares
MCP security gateway and policy proxy, not a vulnerability scanner or single integration skill.
Common Questions / FAQ
Who is app.qwady.thorns/thornguard for?
Solo founders and small teams shipping AI agents with several MCP integrations who need authentication, redaction, policies, and audit logs on remote tool traffic.
When should I use app.qwady.thorns/thornguard?
Use it before widening MCP access beyond your machine—beta users, shared Claude Code setups, or production agents calling sensitive APIs.
How do I add app.qwady.thorns/thornguard to my agent?
Follow the ThornGuard quickstart at https://qwady.wiki/thornguard/quickstart to register the gateway with your MCP client and route remote servers through ThornGuard per Qwady’s deployment guide.