Tripwire Guard — evidence-first injection scanner

io.github.KubaOpoczkaPublished by GitHub account KubaOpoczkav0.4.2Updated Oct 24, 2026

Local read-only MCP scanner for known prompt-injection patterns with exact evidence and no network.

VerifiedSTDIODesktop onlySecurity & MonitoringAI & ML

Overview

AI-generated overview

Local, read-only MCP server that scans untrusted text for known prompt-injection patterns and returns an allow, review or recommend_block decision with…

What you can do
  • Scan untrusted text such as web pages, documents, emails, tickets or RAG chunks for known prompt-injection patterns
  • Get a structured decision (allow, review, recommend_block) with finding count, rule id, severity, category and matched span
  • Record optional provenance for the scanned content, such as a page URL, email, tool result or document name
  • Choose redacted evidence by default, or raw matched evidence on request
  • See the engine and ruleset versions used for each result
When to use it
Useful when an assistant ingests text from outside sources and you want a fast, explainable, offline signal before that text enters its context. It is a heuristic layer, not a guarantee, and is meant to sit alongside least-privilege tools, approval gates and sandboxing.
Requirements
Runs locally over stdio via npx from the npm package tripwire-guard; requires Node.js 22.12 or later. No authentication, environment variables or headers are declared, and it makes no network requests.
Before you install
Results are heuristic: novel, contextual, multilingual, visual or heavily obfuscated attacks can be missed, and a clean result means no known signal matched, not that the content is safe. The host must still enforce the decision; the server does not intercept or authorize other tool calls. Requesting unredacted evidence returns raw matched text, which may include sensitive strings.

Installation

In SourceWeft

  1. Open Tripwire Guard — evidence-first injection scanner in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Tripwire Guard

Public package: tripwire-guard. A clean install and MCP handshake were verified on 13 August 2026.

A local, read-only MCP server that inspects untrusted text for prompt-injection before it enters an AI agent's context.

Give it text (a web page, document, email, ticket, RAG chunk) and it returns an allow / review / recommend_block decision with the exact matched evidence. It runs entirely on your machine, makes no network requests, and redacts emails, URLs and credential-like strings by default.

The engine is deterministic and ships with a public 100-case maintainer-authored evaluation — 85% accuracy, with every false positive and false negative published. It is a fast, explainable signal layer; it is not a guarantee of safety, and the host remains responsible for enforcing the decision.

Unlike an MCP proxy, Tripwire Guard does not intercept or authorize other tool calls. Unlike a model-based detector, it needs no model runtime or API. Pair it with least-privilege tools, approval gates, isolation and action-sink enforcement.

Install / run

Requires Node.js 22.12+.

bash
npx tripwire-guard

Use it in an MCP host

json
{  "mcpServers": {    "tripwire": {      "command": "npx",      "args": ["-y", "tripwire-guard"]    }  }}

The tool

tripwire_scan (read-only) — inputs:

  • content (string, required) — untrusted text to inspect.
  • source (string, optional) — provenance, e.g. a page URL, email, tool result, or document name.
  • includeEvidence (boolean, optional) — return raw matched evidence instead of redacted. Defaults to redacted.

Returns structured evidence: the decision, a finding count, per-finding rule id / severity / category / matched span, and the engine + ruleset versions.

The npm package is versioned independently from the detector engine reported inside each result. Package 0.4.2 currently ships engine 0.3.0 and ruleset 2026.08.2.

Honest limits

Deterministic heuristics can miss novel, contextual, multilingual, visual, or heavily obfuscated attacks. A clean result means "no known signal matched," not "safe." Pair it with least-privilege tools, approval gates, and sandboxing.

Map the surrounding system

Use the free agent action-path worksheet to map an untrusted input, its reachable tools, the consequential action sink, existing controls, and the minimum safe test evidence. It is ungated and contains a clearly labelled synthetic example.

More

Live demo, full benchmark, threat model, and fixed-scope team review: https://tripwire-live.netlify.app

Source and security boundary

This repository contains the distributable MIT-licensed, read-only Guard MCP server and its release metadata. The broader Tripwire browser product and paid review materials are maintained separately. Report package defects through this repository's issue tracker; do not post secrets, customer data, private prompts, or live credentials.

© 2026 Kuba Opoczka.

Source: README.md at commit d65e220

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.4.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts