GuardBee MCP
🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch
Security for AI agents and MCP. GuardBee puts a gateway between your agents and their tools and models that masks personal data and secrets, blocks prompt injection and toxic data flows, asks before risky calls and keeps a tamper-evident audit log, plus scanners that check your code and configs against the OWASP MCP Top 10. Open source (MIT), runs on your machine, no account needed.
# Put your existing MCP servers behind the gateway (backs up your client config first)
npx -y @guardbee/mcp-security-proxy@^1 init --client claude-desktop # or cursor, claude-code
# Check a codebase against the OWASP MCP Top 10
npx -y @guardbee/mcp-owasp-scan scan . --fail-on=high
Run it yourself: examples/demo (npm install && npm start).
Which package should I use?
| You want to… | Install | How |
|---|
| Protect agents at runtime: mask personal data, block injection and toxic flows, approve risky calls, keep an audit log | @guardbee/mcp-security-proxy | Put it in front of your MCP servers (guardbee-proxy init imports your client config) |
| Check a codebase against the OWASP MCP Top 10 in one pass, in CI | @guardbee/mcp-owasp-scan | npx @guardbee/mcp-owasp-scan scan . --format=sarif --fail-on=high |
| Give an agent many GuardBee checks from one MCP server | @guardbee/security-suite | guardbee serve (recommended set), --tools=code,network or all |
| Find leaked keys in files, git history or agent transcripts | @guardbee/mcp-secret-scanner | npx @guardbee/mcp-secret-scanner scan . --history |
| Audit the MCP servers configured on developer machines | @guardbee/mcp-config-auditor | npx @guardbee/mcp-config-auditor discover |
| Let an agent query a database without seeing raw personal data | @guardbee/mcp-db-gateway | Point it at your database with a policy |
| Use the detectors in your own code | @guardbee/guard-core |
Every other package is a single check (one OWASP risk, one protocol, one file type); each is in security-suite too. npx @guardbee/security-suite list shows them with what they check.
Benchmarks
Detection is measured, not claimed: packages/pii-bench is a reproducible benchmark for Turkish and international personal data, with bootstrap 95% intervals and the datasets in the repo.
| Benchmark | Result |
|---|
| Identifiers (TC Kimlik, IBAN, card, phone, e-mail, …), 400 documents + 160 clean | F1 97.1, recall 100%, false alarms on clean documents 8.1%, 0.04 ms per document |
| Person names with the optional NER model, same set | F1 99.5 |
| Hand-written hard cases for names (tr-names-challenge) | F1 97.1, 0 false alarms |
| KVKK Art. 6 special categories with NER (tr-special-challenge) | F1 97.5, 0 false alarms |
Bypass suite: 5 identifiers × 16 disguises (base64, hex, URL/HTML/\u escapes, other scripts' digits, separators) | 80 / 80 masked, 0 of 16 look-alike strings changed |
The identifier detectors were tuned after reading this set's misses, so the challenge sets are the fairer measure; the pii-bench README lists the limits. Any other detector can be run on the same data through its System interface.
Examples
Ready-to-copy proxy policies (minimal, KVKK, coding agent, LLM gateway), client configs for Claude Desktop, Claude Code, Cursor and VS Code, and CI templates for GitHub Actions and GitLab: examples/.
Packages
| Package | npm | Description |
|---|
packages/ai-code-scanner | @guardbee/mcp-ai-code-scanner | Scans a codebase for insecure LLM/AI integration patterns (client-exposed keys, unsafe output handling, excessive agency, PII→prompt, prompt injection) |
packages/compliance-checker | @guardbee/mcp-compliance-checker | KVKK/GDPR/CCPA compliance checks |
packages/dependency-auditor | @guardbee/mcp-dependency-auditor | CVE scanning for npm/pip/cargo dependencies (OSV) |
packages/dns-intelligence | @guardbee/mcp-dns-intelligence | DNS record enumeration, misconfiguration and dangling-subdomain detection |
packages/db-gateway | @guardbee/mcp-db-gateway | KVKK/GDPR-compliant gateway between an LLM and a database (PII masking, RBAC, rate limiting, queryable audit log; Prisma/Postgres/MySQL/SQLite/MongoDB adapters; optional insert/update/delete support) |
packages/mcp-server-auditor | @guardbee/mcp-server-auditor | Scans other MCP servers' tool definitions for insecure patterns (excessive agency, shell/eval/SQL/SSRF sinks, loose schemas, hardcoded secrets, wildcard CORS) |
packages/prompt-injection-scanner |
Security
Found a vulnerability? Report it privately: see SECURITY.md. Contributions are welcome: CONTRIBUTING.md.
Telemetry
Packages can send usage telemetry to GuardBee via @guardbee/mcp-telemetry: which tool is called, how often, and how long it takes. It is off by default (opt-in); nothing is sent unless you set GUARDBEE_TELEMETRY=1. When it is on, a one-time notice is printed to stderr on first use.
- To enable:
GUARDBEE_TELEMETRY=1 (or true/on/yes); unset it to turn telemetry off again
- What's sent: tool name, short (≤40 character) parameter values (e.g.
table: "users", limit: 50), success/failure, duration
- What's NEVER sent: values under keys like
content/text/data/filter/password/email/apiKey/token, and any string longer than 40 characters — all replaced with "[redacted: ...]" by redactParams() in packages/telemetry/src/redact.ts. So the full content of scanned files/code, or the real row data from an insert_row/update_row call, is never sent.
Details: packages/telemetry/README.md.
Development
pnpm install
pnpm build # turbo run build — all packages, in dependency order
pnpm test # turbo run test
To work on a single package:
pnpm --filter @guardbee/mcp-ssl-inspector dev
Versioning and publishing
Packages are versioned independently (Changesets). If you changed something in a PR:
pnpm changeset
After merging to main, CI automatically opens a version PR; merging that PR publishes the changed packages to npm (see .github/workflows/release.yml).
Stability
Packages at 1.0 or later follow semantic versioning: a breaking change to the CLI, the MCP tool names and parameters, the config format or the exported API comes only with a new major version, and is listed in the package's CHANGELOG.md. New rules and detectors arrive in minor versions; they can report findings an earlier version did not. Packages still at 0.x may change between minor versions.
| Package | Stable since |
|---|
@guardbee/mcp-security-proxy | 1.0 |
@guardbee/guard-core | 1.0 |
@guardbee/mcp-secret-scanner | 1.0 |
@guardbee/mcp-prompt-injection-scanner | 1.0 |
@guardbee/mcp-prompt-leak-scanner | 1.0 |
@guardbee/mcp-toxic-flow-auditor | 1.0 |
Structure
- pnpm workspaces —
packages/*, real workspace:* dependencies (e.g. security-suite depends on the other packages directly from the workspace, not a registry version)
- Turborepo —
build/test/type-check pipeline, dependency-graph-aware ordering and caching
- Shared config —
tsconfig.base.json and vitest.shared.ts at the root; each package layers its own settings on top
Project history
The monorepo's earlier write-ups are in CHANGELOG.md; each package's release notes are in its own CHANGELOG.md and on GitHub Releases.
