MCP-Dandan

MCP-Dandan is an integrated monitoring framework that watches MCP traffic to detect security threats in real time. It provides a desktop UI for easy monitoring, controls for real-time threat blocking, and multi-engine detection to help you secure MCP communications across platforms.

How to use

You run MCP-Dandan to observe MCP communications from your MCP client and take immediate action when threats are detected. Use the HTTP endpoint to monitor remote MCP activity and the local desktop UI to review alerts, configure detectors, and block suspicious actions in real time. You can enable the Tools Poisoning Engine with your API key to strengthen semantic checks and automatically categorize threat severity.

How to install

Prerequisites: ensure you have Node.js and Python installed on your system. You will also need npm to install dependencies.

Install and run MCP-Dandan with the following steps:

# Clone the project
git clone https://github.com/82ch/MCP-Dandan.git
cd MCP-Dandan

# Install all dependencies (Python + Node.js)
npm run install-all

# Start the application (server + Electron UI)
npm run dev

Configuration and usage notes

MCP-Dandan starts a local server at http://127.0.0.1:8282. The Electron-based desktop UI launches automatically and provides a real-time dashboard, an interactive tutorial, and a blocking interface for threat responses.

Security, settings, and tools

The framework includes multiple detection engines and settings to tailor behavior to your environment. You can configure engines, review logs, and adjust blocking policies from the Settings Panel in the desktop UI. The Tools Poisoning Engine can be enabled with your API key to access semantic analysis and severity scoring for MCP tool usage.

Examples and workflows

Real-time monitoring and blocking workflow:

• Run MCP-Dandan and connect your MCP client to the local MCP endpoint.
• Let MCP-Dandan analyze traffic in real time.
• Review alerts in the dashboard and apply blocking actions as needed to mitigate threats.

Troubleshooting

If the UI does not launch automatically after starting the server, check the terminal output for startup errors, verify that Node.js and Python are installed, and ensure port 8282 is not in use by another process.

Tools and capabilities overview

MCP-Dandan exposes a suite of engines and features including real-time MCP traffic monitoring, multi-engine threat detection (command injection, file system exposure, PII leakage with custom rules, data exfiltration, and Tools Poisoning with AI-based analysis), a blocking interface, a cross-platform desktop UI, and an interactive tutorial.

Technical details

The application ships with a real-time dashboard, a chat/log panel, and a settings panel to configure detection engines and system behavior. You can input your MISTRAL_API_KEY to enable the Tools Poisoning Engine.

Code snippets and config

{
  "mcpServers": {
    "mcp_dandan_http": {
      "type": "http",
      "name": "mcp_dandan_http",
      "url": "http://127.0.0.1:8282",
      "args": []
    },
    "mcp_dandan_dev": {
      "type": "stdio",
      "name": "mcp_dandan_dev",
      "command": "npm",
      "args": ["run","dev"],
      "env": [
        {"name": "MISTRAL_API_KEY", "value": "YOUR_API_KEY"}
      ]
    }
  }
}

Available tools

real_time_traffic_monitor

Monitors MCP traffic in real time and provides live visibility into communications.

command_injection_engine

Detects potential command injection patterns within MCP tool calls.

file_system_exposure_engine

Tracks unauthorized access to the file system and flags risky paths.

pii_leak_engine

Detects potential PII leakage with built-in rules and supports custom user rules.

data_exfiltration_engine

Identifies suspicious data transfer patterns and exfiltration attempts.

tools_poisoning_engine

LLM-based analysis to detect misuse of MCP tools and categorize severity.

blocking_interface

Allows real-time threat blocking actions from the UI.

desktop_ui

Electron-based desktop UI for real-time monitoring and control.

interactive_tutorial

Built-in, step-by-step tutorials to help new users learn the system.

cross_platform_support

Supports Windows, macOS, and Linux environments.