GuardianMCP Server

🛡️ GuardianMCP - Your vigilant security companion that automatically guards your projects against vulnerabilities

javascript

1

GitHub Stars

javascript

Language

6 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "kalvisan-guardian-mcp": {
      "command": "npx",
      "args": [
        "guardian-mcp"
      ]
    }
  }
}

GuardianMCP is an MCP server that automatically scans your project dependencies for known security vulnerabilities using the OSV.dev database. It works with common MCP-enabled IDEs to provide real-time alerts, remediation guidance, and efficient auto-scan options so you can keep dependencies secure without slowing down your workflow.

How to use

You install GuardianMCP and connect it to your MCP-enabled IDE. Once connected, you can run on-demand scans or enable automatic scans that trigger on project events such as install, build, or commit. Your IDE will surface vulnerabilities by severity and provide remediation steps and CVE references. Use the check_vulnerabilities tool to perform scans with different levels of detail.

How to install

Prerequisites you need before installation: Node.js LTS (recommended for GuardianMCP), npm, and Docker if you choose a containerized setup.

# Global installation (recommended for most users)
npm install -g guardian-mcp

# From source (clone, install, build)
git clone https://github.com/Kalvisan/guardian-mcp.git
cd guardian-mcp
npm install
npm run build

# Docker (pull the latest image)
docker pull kalmars/guardian-mcp:latest
# or use docker-compose if provided
docker-compose up -d

Additional sections

Configuration for IDE integration is provided as explicit runtime commands. GuardianMCP can be run as a local, stdio MCP server or accessed via an MCP URL when using remote hosting. The following local MCP configurations are provided for direct usage with an IDE.

Two explicit stdio configurations are shown here. Each configuration uses the GuardianMCP runtime to provide the MCP interface to your IDE.

{
  "type": "stdio",
  "name": "guardian_mcp_npx",
  "command": "npx",
  "args": ["guardian-mcp"]
}

If you prefer a local run with a built distribution, this configuration uses a direct Node invocation pointing to the built index. Replace the absolute path with your actual path after building.

{
  "type": "stdio",
  "name": "guardian_mcp_local",
  "command": "node",
  "args": ["/absolute/path/to/guardian-mcp/dist/index.js"]
}

IDE-specific setup snippets describe how to wire GuardianMCP into Cursor, Visual Studio Code, Claude Desktop, Windsurf, and Zed. Each uses either npx guardian-mcp or a local node invocation to start the MCP server. Enable auto-scanning by adding project rules that trigger the check_vulnerabilities tool on defined events.

Available tools

check_vulnerabilities

Tool to perform vulnerability scans on the project dependencies with configurable scan_mode options (full, summary, critical-high-only).