mcp-guard

Security and network MCP server for Claude Code and Cursor. Written in Go.

---

Why mcp-guard

Most MCP servers are API wrappers. Claude could look up the same data itself if it had web access.

mcp-guard is different. 12 of its 22 tools require a physical machine to function. Wi-Fi scanning needs a radio chip. Bluetooth scanning needs an adapter. ARP discovery sends Layer 2 frames that never leave your local network — no cloud service receives them. File watching subscribes to kernel events on your machine's filesystem. USB enumeration reads your physical ports.

Claude runs in a data center. It has none of these things. These tools only work because the binary is running on your computer.

---

Tools

Local hardware (impossible for any remote service)

Tool	What it does
wifi_scan	Scan nearby Wi-Fi networks via your wireless hardware — SSID, BSSID, signal, channel, security
bluetooth_scan	Enumerate nearby Bluetooth devices via your adapter — name, address, type, pairing status
usb_devices	List all USB devices connected to this machine — vendor, product ID, speed, manufacturer
arp_scan	Layer 2 LAN discovery — finds every device on your network including ones that block ICMP/TCP, with MAC addresses and vendor IDs
ping_sweep	ICMP host discovery across a CIDR range from your machine's network stack
traceroute	Hop-by-hop network path from this machine via ICMP TTL probes
file_watch	Kernel FS event stream (FSEvents on macOS, inotify on Linux) — real-time create/write/delete/rename
sys_info	Local hardware: CPU model, RAM, disk, uptime, all network interfaces with IPs and MACs
open_files	Every file, socket, and pipe held open by processes on this machine via lsof
proc_list	Running processes with CPU% and memory — filter by name
net_connections	Live TCP connections on this machine (netstat -an)
scan_secrets	Walk local files for hardcoded credentials — 20+ patterns (AWS, GitHub, OpenAI, Stripe, Slack, DB URLs, private keys)
hash_files	SHA-256 every file in a directory — integrity baseline before/after deploys

Forensics and supply chain

Tool	What it does
persistence_scan	Checks this machine for malware persistence: LaunchAgents/Daemons (macOS), systemd units (Linux), cron jobs, shell profile injections. Flags curl-pipe-to-bash, base64 payloads, binaries in /tmp
supply_chain_audit	Audits node_modules for supply chain attacks: lifecycle scripts that download/execute remote code, typosquatting (Levenshtein distance 1 against 50 popular packages), eval() of runtime data in source

Network utilities

Tool	What it does
port_scan	Concurrent TCP scanner — 200 goroutines, service name lookup
banner_grab	Raw TCP banner from any protocol — SSH, FTP, SMTP, Redis, MySQL
ssl_inspect	Full TLS certificate chain — key size, algorithm, expiry, SANs
dns_enum	A, AAAA, MX, NS, TXT, CNAME — detects missing SPF/DMARC
audit_headers	HTTP security header audit scored 0–100 with letter grade
check_cves	npm dependency CVE check via OSV — no API key
jwt_decode	Local JWT decode — algorithm, expiry, security warnings

---

Setup

Claude Code

Add to ~/.claude/settings.json:

{
  "mcpServers": {
    "mcp-guard": {
      "command": "npx",
      "args": ["-y", "@zent7x/mcp-guard"]
    }
  }
}

Cursor

Add to .cursor/mcp.json:

{
  "mcpServers": {
    "mcp-guard": {
      "command": "npx",
      "args": ["-y", "@zent7x/mcp-guard"]
    }
  }
}

Global install

npm install -g @zent7x/mcp-guard

Then use "command": "mcp-guard" instead of npx in the config above.

---

Example output

> wifi_scan

Wi-Fi networks (8 found)

SSID                              BSSID               SIGNAL    CHANNEL  SECURITY
──────────────────────────────────────────────────────────────────────────────────────────
HomeNetwork                       a4:c3:f0:11:22:33   -42 dBm   6        WPA2 Personal
OfficeWifi                        b8:27:eb:44:55:66   -67 dBm   11       WPA2 Enterprise

> arp_scan 192.168.1.0/24

LAN devices in 192.168.1.0/24 (6 found)

IP                  MAC                  HOSTNAME              VENDOR
────────────────────────────────────────────────────────────────────────────────
192.168.1.1         a4:c3:f0:ab:cd:ef    router.local          Apple
192.168.1.42        b8:27:eb:12:34:56    raspberrypi.local     Raspberry Pi
192.168.1.100       00:0c:29:78:90:ab                          VMware

> bluetooth_scan

Bluetooth devices (4 found)

NAME                            ADDRESS               TYPE                  STATUS
─────────────────────────────────────────────────────────────────────────────────────────
AirPods Pro                     a1:b2:c3:d4:e5:f6                           paired
MX Keys                         11:22:33:44:55:66     Keyboard              paired
Sony WH-1000XM5                 aa:bb:cc:dd:ee:ff     Headphones            not paired

---

How it works

The npm package downloads a pre-compiled Go binary for your platform on first run. The binary speaks the MCP stdio protocol — your editor spawns it on startup and the tools appear automatically.

Platform binaries: darwin-arm64, darwin-amd64, linux-amd64, linux-arm64, windows-amd64.

---

Build from source

git clone https://github.com/zent7x/mcp-guard
cd mcp-guard
go build -o mcp-guard .

Requires Go 1.21+.

---

License

MIT