mcp-guardian

MCP Guardian serves as a control plane layer for your MCP server ecosystem. It gives you real-time visibility into an LLM’s interactions with MCP servers through message logging, and it provides interactive message approvals so you can permit or deny individual tool calls as they come through. A key capability is centralized management of multiple MCP server configurations, enabling you to switch between different server collections without manually editing configuration files for each host application. While Guardian already surfaces traces of MCP server activity, an automated message scanning feature is planned to perform ongoing safety and privacy checks in real time.

To use Guardian, start the Guardian binary in your environment (for example, ensure the binary is accessible on your PATH) and connect your MCP host applications to Guardian’s control plane. Use the logging view to monitor activity traces and the approvals interface to approve or deny tool calls on the fly. As new MCP servers are added to Guardian, you can organize them into collections and switch between them as needed to support different assistants or tasks.

Prerequisites:

• A supported development or runtime environment (Linux/macOS with Nix or Windows with the recommended toolchain)
• Access to the project repository and build tooling per the project’s guidance

Installation steps (Linux/macOS with Nix):

1. Install Nix: https://nixos.org/download/
2. Enable nix flakes: sudo sh -c 'echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf'
3. Enter the development shell: nix develop
4. Build the project: just build-release
5. Ensure mcp-guardian is in your PATH: after a successful build, mcp-guardian and mcp-guardian-proxy appear in _build/bin/ and should be discoverable in your PATH

If you prefer a local binary without the dev shell, refer to the repository's docs for any published release artifacts or alternative build instructions specific to your platform.

Tips and common issues:

• Ensure the Guardian binary is executable and accessible in your PATH before starting your MCP host applications.
• When running Guardian in production, consider setting a log level via the RUST_LOG environment variable (e.g., RUST_LOG=info or RUST_LOG=debug) to capture the desired amount of detail.
• If you maintain multiple MCP server configurations, organize them into named collections within Guardian and use the built-in switching mechanism to move between them.
• If you encounter build or runtime issues, consult the project’s development documentation for environment-specific steps (Linux/macOS vs Windows) and verify that dependencies (e.g., nix, cargo, etc.) are correctly installed.