Security gateway and verification layer for MCP agents.
Security gateway and verification layer for MCP agents. That is what the mcpvanguard mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.
McpVanguard sits between an AI agent and an MCP server, normalizes and inspects tool traffic in real time, and enforces a layered policy before sensitive calls reach the underlying tool. It runs locally in front of stdio servers or as a hosted gateway over SSE and Streamable HTTP.
The server publishes 14 tools. What each one is for:
Local — first mode**: wraps stdio MCP servers on a developer machinecross — server isolation and server_id traceabilitysigned — manifest, provenance, detached signature, and Sigstore-backed trust verificationdisabled — no native management tools are exposedsame_session_dev — local/dev only; read and mutating tools share the governed MCP session and startup prints a warningoperator_only — read-only tools may be visible, but mutating tools require an admin role or vanguard:admin / scope:admin scopeIssues — github.com/provnai/McpVanguard/issuesContact — contact@provnai.comSecurity — see SECURITY.mdLayer — PurposeAuth — OAuth scope enforcement and destructive-tool policyBackend — Env VarsBecause this one is hosted, setup is mostly authentication — you point your client at the endpoint and approve access. Nothing runs on your machine, so there is no runtime to keep patched.
Configuration is passed through the environment: VANGUARD_API_KEY, VANGUARD_SEMANTIC_CUSTOM_KEY, VANGUARD_OPENAI_API_KEY, VANGUARD_OLLAMA_URL. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Mcpvanguard's toolset — Local, cross, signed and 11 more — is a fair guide to whether it matches your workflow. It is maintained by provnai; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| Local | first mode**: wraps stdio MCP servers on a developer machine |
| cross | server isolation and server_id traceability |
| signed | manifest, provenance, detached signature, and Sigstore-backed trust verification |
| disabled | no native management tools are exposed |
| same_session_dev | local/dev only; read and mutating tools share the governed MCP session and startup prints a warning |
| operator_only | read-only tools may be visible, but mutating tools require an admin role or vanguard:admin / scope:admin scope |
| Issues | [github.com/provnai/McpVanguard/issues](https://github.com/provnai/McpVanguard/issues) |
| Contact | [contact@provnai.com](mailto:contact@provnai.com) |
| Security | see [SECURITY.md](SECURITY.md) |
| Layer | Purpose |
| Auth | OAuth scope enforcement and destructive-tool policy |
| Backend | Env Vars |
| OpenAI | VANGUARD_OPENAI_API_KEY |
| Ollama | VANGUARD_OLLAMA_URL |
{
"mcpServers": {
"mcpvanguard": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem"],
"env": {
"VANGUARD_API_KEY": "your-value",
"VANGUARD_SEMANTIC_CUSTOM_KEY": "your-value",
"VANGUARD_OPENAI_API_KEY": "your-value",
"VANGUARD_OLLAMA_URL": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| VANGUARD_API_KEY | Credential the server authenticates with. | Yes |
| VANGUARD_SEMANTIC_CUSTOM_KEY | Credential the server authenticates with. | Yes |
| VANGUARD_OPENAI_API_KEY | Credential the server authenticates with. | Yes |
| VANGUARD_OLLAMA_URL | Endpoint or connection string the server talks to. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.