MCP security checks — WARDEN and HISTOR

WARDEN — MCP security firewall

Vets what an MCP server *says* its tools do — tool poisoning, rug pulls, requests for secrets, instructions to send data elsewhere — against static rules, a signed threat feed, origin and tool-definition pinning, before any tool reaches the model. A CLI scan of the servers your clients start, a stdio wrap proxy for Claude Desktop / Cursor / Claude Code, a Claude Code hook, and a zero-dependency TypeScript library.

Check every MCP server on your machine. No account, no API key, no model. scan starts each server in your config the way your client would, reads its tools/list, vets it and stops it; the only network traffic is to those servers.

npx -y @aimarket/warden@0.23.0 scan

WARDEN scan 0.23.0 · ruleset 17 sha256-UOfK25xo6D8v… · block at high

read .mcp.json (claude-code, 3 servers)

✓ allow notes claude-code 1 tool · score 0.90 ✗ BLOCK evil-notes claude-code 1 tool · score 0.00 · TOOL_DEF_EXFIL(save_note) TOOL_DEF_SECRET_REQUEST(save_note) THREAT_SSH_KEY_READ(save_note) THREAT_SEED_PHRASE(save_note) ! error broken claude-code could not start: spawn /nonexistent/bin/server ENOENT

⚠ toxic flow claude-code has a possible private-data / untrusted-input / outbound path: capabilities of notes.save_note are unknown. Review and bind operator capabilities to the launch identity and definitions; unrecognized names are not evidence of safety.

3 servers: 1 allowed, 1 blocked, 1 not checked, 0 skipped. Details: warden-mcp scan --json, or --markdown FILE. To review a changed server: warden-mcp scan --lock warden.lock.json --update-lock.

That is the real output of 0.23.0 on examples/scan-demo/: three tiny stdio servers, one of them poisoned. cd examples/scan-demo && npx -y @aimarket/warden@0.23.0 scan --project reproduces it with nothing installed. Scan guide.

Against four other open-source scanners on the same servers, each in a gVisor container with no network: on the held-out half of MCPTox (an AAAI 2026 benchmark; WARDEN's rules were written from the other half) WARDEN blocked 171 of 218 poisoned tools with the rules of that comparison (v12) and blocks 210 since ruleset v16, the others 8 to 41. On 986 public servers it blocks 3 and on 14,933 npm and PyPI packages 369; mcp-shield blocks 343 and 5,354. Method and every number · scan guide · [for teams: one policy, a lock per repository, weekly checks](docs/teams.md).

=20" />

🔄 Synced from the AI-Factory monorepo (append-only history). Pull requests are welcome — merged PRs are imported back and re-synced here. Issues · Pull requests

🌐 English · Русский · Español · Français · 中文 · Glossary

WARDEN quality cycle: MOMUS → AI-Factory → SKOPOS → shared node agent → deployment.

[Final ranking-feedback comparison, 26 October](docs/flow-guard-final-witness-2026-10-26.md). On all five previously withheld contexts, old feedback repaired 6/40 continuations and explicit selected-versus-best feedback repaired 40/40. Valid controls stayed valid 20/20 per nominal arm. This completes the series on selected known failures, not a new holdout. The earlier offline-only statement is superseded for ranking feedback on this cohort; missing-set feedback efficacy remains unmeasured.

Flow guard (local source, 2026-10-23). After credentials and outside text, outbound/MCP calls and ordinary project writes require review, regardless of short fragments or unknown encodings. Exact operator-reviewed public requests can run once per session; known leaks and incomplete scans stay blocked from this exemption. Fixture: 0/16 attacks automatically allowed in both modes; 12/12 benign calls reviewed by default, 0/12 with exact public rules. This is an explicit usability tradeoff, not universal decoding. The unchanged 23-case replay remains 0/23 fully delivered. Production/npm are unchanged. Policy, tests and limits.

Ruleset v16 (0.20.0, 2026-10-22, WARDEN only): MCPTox held-out half 210 of 218 (v15: 194, v12–v14: 171), 0 of 45 clean servers; on the field corpus and a 1,000-package HISTOR sample it blocks exactly what v15 blocked. Ruleset v17 (0.23.0, 2026-11-01) adds a case from outside MCPTox, a tool that adds a BCC to another server's send_email, and changes no verdict on any of these sets. The comparison with other scanners above is from 2026-10-16 with v12. v15 and v16 in the gate chain.

0.7.0 security changes and migration: vetLaunch, durable pins, anti-rollback, ruleset v6, runtime revalidation.

One MCP server. Security firewall for advertised tool definitions. Library included.

Transport: stdio (npx -y @aimarket/warden / node dist/mcp-server.js). Compatible hosts: Claude Desktop, Cursor, Glama, and any MCP client that speaks stdio. No API keys.

An MCP server tells your agent what its tools do. The agent believes it — that sentence is the attack surface. A tool description is prompt text delivered by a third party straight into your model's context, and a schema field named api_key is a request for your secrets phrased as an API.

WARDEN vets a server before any of its tools reach the model, and returns a verdict you can record: allow/block, a 0..1 score, the findings that produced it, a per-tool partition, and the exact rule table that was in force.

Zero npm runtime dependencies. The library's only import is node:crypto. The stdio MCP server adds other node: builtins (fs, path, process) and still pulls in no packages. It is the firewall out of ARGUS, extracted so you can put it in front of your own MCP host without adopting an agent.

Decimal/NATO secret encodings and MCP Git commit/push now have regressions; the complete 28-case hook replay is a failing local CI/release gate (npm run test:redteam).

Auten follow-up: opt-in taskAdapter.mode: "review" / task_run asks once for a fixed outcome; wrap --screen-read can cancel an approved GUI action after a fresh target check. Strict GUI remains default; snapshot and click are not atomic.

Atomic screen opt-in: wrap --flow screen --screen-read screenshot --screen-atomic requires a trusted server-side revision/target CAS (AtomicScreenServer, warden.screen.atomic.v1). No raw-click fallback; server-owned synchronous surfaces only. A runnable virtual-form example is included; arbitrary native desktop atomicity is not claimed.

Native macOS: npm run build:macos builds the target-side AppKit SDK and a real native demo window; npm run test:macos runs its separate integration gate. Atomicity requires embedding WardenDesktopSurface in the application that owns the controls; unrelated apps are refused. See macOS integration.

Constrained task mode: fewer confirmations, actual effect control

Strict GUI remains the default. Legacy gui.mode: "policy" / gui.allow are parsed for migration but no longer authorize a click, typing or a navigation key after outside text. Even an exact origin, role and accessibility ID can be spoofed by the page. Geometry, focus and translated labels explain the request only. Composite keyboard names such as press_keys_then_execute cannot use the Copy exception. Extra RPC metadata never receives automatic authorization.

Opt-in constrained operations: node dist/mcp-server.js task. See the task adapter, payments, limits and fresh AgentDojo replay. Local source only; no publication or deployment.

Protect Claude Desktop or Cursor with one wrapper

Use 0.8.2 or later: 0.8.0 and 0.8.1 let a wrapped server forge the reply to the client's own `tools/list` (CHANGELOG). From source, node /absolute/path/warden/dist/mcp-server.js wrap ... works the same. Adding WARDEN as a separate MCP server does not inspect other servers. Tested end to end with the MCP TypeScript SDK and fixture servers; runs in Claude Desktop and Cursor themselves are not yet recorded (release validation). Replace each protected server’s command with wrap:

{

"mcpServers": { "filesystem": { "command": "npx", "args": ["-y", "@aimarket/warden@0.23.0", "wrap", "--id", "filesystem", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/Users/me/docs"] } } }

For explicit first-contact review, add --require-approval to wrap. It withholds new definitions until warden-mcp pins approve --id filesystem in an operator terminal, then rejects any changed field or launch identity. Automatic/legacy pins need reapproval. See the language-independent admission boundary.

Always specify --id: without it, changing command arguments creates a new identity and a new first contact. A stable ID turns a command or path change into SERVER_IDENTITY_DRIFT. Environment variables are inherited by the child and excluded from identity. To avoid repeated cold npx starts, install globally with npm install -g @aimarket/warden@0.23.0, then use warden-mcp.

Sensitive tools. A policy file's sensitiveToolPatterns (--policy policy.json with {"sensitiveToolPatterns": ["*delete*", "*transfer*"]}, case-insensitive * globs) makes every call to a matching tool wait for a person: wrap asks through the client's own form (MCP elicitation) wi