Threat Rules

io.github.GuardBeePublished by GitHub account GuardBeev0.5.1Updated Nov 3, 2026

GuardBee MCP bridge to Agent Threat Rules (ATR) for runtime agent/MCP threat detection

VerifiedSTDIODesktop onlySecurity & MonitoringAI & ML

Overview

AI-generated overview

Local MCP bridge to Agent Threat Rules (ATR) that lets an assistant score text, files and agent events for prompt injection, tool poisoning and MCP attack…

What you can do
  • Evaluate free text, local files and structured AgentEvent JSON against ATR plus GuardBee rules, returning matches and follow-up scanner hints
  • List loaded detection rules and summarize rule counts by category and source (ATR vs GuardBee)
  • Explain how ATR runtime rules complement GuardBee static MCP auditors
  • Map runtime findings to OWASP Top 10 for LLM Applications (2025) and MITRE ATLAS
When to use it
Useful when you want an assistant to check prompts, tool outputs, files or agent events for known AI-agent threat patterns at runtime, and to point to the matching GuardBee auditor for deeper review.
Requirements
Runs as a local stdio process from the npm package @guardbee/mcp-threat-rules (Node.js/npx). No authentication, environment variables or headers are declared. Custom rules can be added as YAML in a project rules directory or via the GUARDBEE_ATR_RULES_DIR variable.
Before you install
evaluate_file reads local file contents and sends them into the rule evaluation, so point it only at files you are willing to process. Telemetry is off by default; setting GUARDBEE_TELEMETRY=1 sends server, tool, success, duration and short parameter values such as file paths to a third party, with longer strings and fields like content, token or password replaced by a placeholder.

Installation

In SourceWeft

  1. Open Threat Rules in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@guardbee/mcp-threat-rules

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

GuardBee MCP bridge to Agent Threat Rules (ATR) — the open, Sigma-like detection standard for AI agent threats (prompt injection, tool poisoning, context exfiltration, MCP attacks).

ATR evaluates runtime events. GuardBee’s other packages mostly scan source/catalogs. This package connects both: run ATR plus GuardBee rules (KVKK / Turkish & Chinese injection / Chinese ID / lethal-trifecta intent), then jump to the matching GuardBee auditor.

Custom project rules: drop YAML into .guardbee/atr-rules/ or set GUARDBEE_ATR_RULES_DIR.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► threat-rules (ATR) ──► matches + GuardBee follow-up hints              │              ├─ evaluate_text / evaluate_file / evaluate_event              ├─ list_rules / rule_stats              └─ explain_bridge

Built-in GuardBee rules include KVKK TC Kimlik, Turkish & Chinese injection, Chinese national ID, and lethal-trifecta intent (GB-ATR-2026-00001 … 00005).

Upstream ATR is MIT-licensed and already used across the industry. We depend on agent-threat-rules rather than forking it.

Tools

ToolPurpose
evaluate_textScore free text against ATR + GuardBee rules
evaluate_fileScore a local file
evaluate_eventScore a structured ATR AgentEvent JSON
list_rulesList loaded rules (source=atr|guardbee)
rule_statsCounts by category/source
explain_bridgeHow ATR maps onto GuardBee scanners
framework_mapHow GuardBee runtime findings map to OWASP LLM Top 10 (2025) and MITRE ATLAS — the mapping guardbee-proxy report uses

CLI

npx @guardbee/mcp-threat-rules eval "…" --format=json --fail-on=highnpx @guardbee/mcp-threat-rules scan ./prompt.txt --format=sarifnpx @guardbee/mcp-threat-rules list --source=guardbeenpx @guardbee/mcp-threat-rules stats

Related GuardBee packages

ATR categoryGuardBee follow-up
prompt-injection@guardbee/mcp-prompt-injection-scanner
tool-poisoning@guardbee/mcp-tool-poisoning-scanner
context-exfiltration@guardbee/mcp-toxic-flow-auditor, @guardbee/mcp-prompt-leak-scanner
privilege-escalation@guardbee/mcp-oauth-auditor, @guardbee/mcp-server-auditor

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Source: packages/threat-rules/README.md at commit bc5997d

Tools

7

evaluate_text

Evaluate free text against Agent Threat Rules (ATR) plus GuardBee KVKK/TR rules. Returns matches with follow-up scanner hints.

ParameterslanetypeformatcontentrequiredscanContext

evaluate_file

Read a local file and evaluate its contents against ATR + GuardBee rules

Parameterslanepathrequiredtypeformat

evaluate_event

Evaluate a structured ATR AgentEvent JSON (type, content, fields, sessionId, …).

Parameterslaneeventrequiredformat

list_rules

List loaded ATR + GuardBee detection rules (optionally filter by category or source).

Parameterslanesourcecategory

rule_stats

Summarize loaded rule counts by category and source (ATR vs GuardBee)

Parameterslane

explain_bridge

Explain how Agent Threat Rules (ATR) complements GuardBee static MCP auditors

Takes no parameters.

framework_map

Show how GuardBee's runtime findings map to OWASP Top 10 for LLM Applications (2025) and MITRE ATLAS — the mapping guardbee-proxy report uses

Takes no parameters.

Version history

9
  1. v0.5.1LatestOct 30, 2026
  2. v0.4.2Oct 22, 2026
  3. v0.3.7Oct 21, 2026
  4. v0.3.6Oct 20, 2026
  5. v0.3.4Oct 19, 2026
  6. v0.3.3Oct 16, 2026
  7. v0.3.2Oct 15, 2026
  8. v0.3.0Oct 14, 2026
  9. v0.2.1Oct 13, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts