v0.2.3

Security scanner, runtime proxy, and audit logger for MCP servers.

Highlights

• 22 checks across 3 suites (compliance, security, advisory) — ~2 seconds per scan
• Tool poisoning detection — ~45 regex patterns + optional ML classifier (DeBERTa)
• SARIF 2.1.0 output — native GitHub Code Scanning integration
• CWE mapping — all security checks include CWE identifiers
• Runtime proxy — auth, rate limiting, tool filtering, audit logging
• Actionable recommendations — grouped findings with ready-to-use --deny commands

Install

pip install mcp-shield-cli

Quick start

# Scan a server
mcp-shield test "npx -y @modelcontextprotocol/server-filesystem /tmp"

# Runtime firewall
mcp-shield proxy "npx server" --deny "delete_*" --rate-limit 30

# Query audit logs
mcp-shield audit show --blocked

GitHub Actions

Use thuggeelya/mcp-shield-action@v1 for CI integration with automatic PR comments and SARIF upload.