Mcp Safeguard
Scan third-party MCP servers for prompt injection, leaked secrets, SSRF, and tool poisoning before you wire them into Claude Code or Cursor.
Overview
com.cognivators/mcp-safeguard is a MCP server for the Ship phase that scans other MCP servers for prompt injection, credential leaks, SSRF, and tool poisoning.
What is this MCP server?
- Detects prompt-injection patterns in MCP tool descriptions and server metadata
- Flags credential leaks and unsafe secret handling in server configs
- Surfaces SSRF-style risky endpoints exposed through tools
- Identifies tool-poisoning and ambiguous or over-privileged tool definitions
- Runs as stdio MCP via PyPI package mcp-safeguard (v0.3.2)
- Server version 0.3.2 on PyPI (stdio)
- Covers 4 advertised threat classes: prompt injection, credential leaks, SSRF, tool poisoning
What problem does it solve?
Installing unknown MCP servers can silently expose your agent to hijacked prompts, stolen API keys, and dangerous outbound requests.
Who is it for?
Indie builders curating a personal MCP stack who want a quick guardrail before enabling write tools or production credentials.
Skip if: Teams that only use first-party MCP from Anthropic with no third-party servers, or who already run full SOC2-grade supply-chain review.
What do I get? / Deliverables
You get a structured security pass on candidate MCP servers before registering them in Claude Code, Cursor, or Codex.
- Security findings across injection, secrets, SSRF, and tool-poisoning categories
- Go/no-go signal before registering risky MCP servers
- Repeatable pre-ship checklist for MCP stack changes
Recommended MCP Servers
Journey fit
How it compares
MCP-specific security scanner, not a general application SAST or secrets manager.
Common Questions / FAQ
Who is com.cognivators/mcp-safeguard for?
Solo and small-team builders who install community MCP servers and need a fast check for injection, leaks, SSRF, and poisoned tools before go-live.
When should I use com.cognivators/mcp-safeguard?
During Ship security review whenever you add or update a third-party MCP server in your agent config, especially before production API keys are reachable.
How do I add com.cognivators/mcp-safeguard to my agent?
Install the PyPI package mcp-safeguard (0.3.2), register it as a stdio MCP server in your client’s mcp.json, and run scans against servers you are evaluating.