ThornGuard

app.qwady.thornsPublished by thorns.qwady.appv0.1.0Updated Oct 24, 2026

Remote MCP security gateway for auth, redaction, policy enforcement, and audit logging.

VerifiedSTDIODesktop onlySecurity & Monitoring

Server details

Identifier: app.qwady.thorns/thornguard
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to thorns.qwady.app. It runs from a package rather than a hosted endpoint, so there is no endpoint to match against that domain.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/app.qwady.thorns%2Fthornguard.svg)](https://sourceweft.com/mcp/app.qwady.thorns%2Fthornguard?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

ThornGuard is a local, desktop-only MCP security gateway that adds authentication, redaction, policy enforcement and audit logging to remote MCP connections.

What you can do: Acts as a gateway in front of remote MCP servers rather than exposing its own tool set.
Applies authentication to connections passing through it.
Redacts sensitive content in traffic it handles.
Enforces policy rules on what is allowed through.
Records audit logs of gateway activity.
No tools are listed in the manifest, so the exact operations are not documented here.
When to use it: Consider it when an assistant connects to remote MCP servers and you want a control point for authentication, data redaction, policy checks and an audit trail. It is aimed at desktop setups, since it runs as a local process and is marked desktop only.
Requirements: Runs as a local process over stdio on the user's machine; desktop only, with no web executable. No packages, environment variables, headers or authentication are declared in the manifest, so setup details are not specified here.

Before you install

It sits in the path of traffic to remote MCP servers, so it can see the data passing through; confirm how redaction and audit logs are stored and where they are sent. No credentials or configuration are declared, so verify what it asks for at install time before trusting it with sensitive traffic.

Installation

In SourceWeft

Open ThornGuard in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.1.0LatestSep 16, 2026

Score

25% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
License10 pts
Declare a license in the repository or the registry entry.