GuardianShield

io.github.sparkvibe-io由 GitHub 账号 sparkvibe-io 发布v1.2.1更新于 Oct 24, 2026

AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

本地 MCP 服务器，为助手提供安全扫描能力：代码漏洞、密钥、PII、提示注入与依赖 CVE，并记录审计日志。

可以做什么
  • 扫描代码、单个文件、目录、diff 及多个文件中的漏洞与硬编码密钥
  • 检查用户输入中的提示注入，以及 AI 输出中的 PII 泄露与内容违规
  • 解析依赖清单并通过 OSV.dev 检查已知 CVE，同步本地漏洞库
  • 管理误报记录，并选择分析引擎（正则、跨行污点追踪、语义）
  • 导出 SARIF、保存基线、执行增量扫描并评估质量门禁，用于 CI
  • 切换安全配置档，查询审计日志、历史发现与服务器状态
适用场景
适合在助手审查或编写代码时，让它标出注入类缺陷、泄露的凭据、PII 或存在漏洞的依赖；也适合需要可重复的 CI 检查，配合基线、SARIF 导出与质量门禁的场景。
运行要求
以 stdio 方式在本机运行，安装 PyPI 包 guardianshield（pip 安装，以 guardianshield-mcp 启动）。可选环境变量 GUARDIANSHIELD_PROFILE、GUARDIANSHIELD_AUDIT_PATH、GUARDIANSHIELD_DEBUG。依赖检查会访问 OSV.dev，因此 CVE 查询需要网络。
安装前请注意
被扫描的代码、发现结果与审计历史会写入 GUARDIANSHIELD_AUDIT_PATH 指定的本地 SQLite 数据库，请选择合适路径。依赖检查会把包名和版本发送给 OSV.dev。发现结果可能包含敏感代码片段，误报记录与基线会持久保存并影响后续扫描。

安装

在 SourceWeft 中

  1. 打开 控制台中的 GuardianShield，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

GuardianShield

[PyPI version] [Python] [License] [Tests]

Universal AI security layer — an open-source MCP server for code scanning, PII detection, prompt injection defense, secret detection, dependency auditing, and audit logging.

Zero dependencies · 27 MCP tools · 5 safety profiles · 108+ detection patterns

Features

  • Code Vulnerability Scanning — SQL injection, XSS, command injection, path traversal with CWE IDs and auto-fix remediation
  • Cross-line Data Flow Analysis — DeepEngine tracks tainted data from sources to sinks across multiple lines using AST-based taint propagation (Python) and regex (JS/TS)
  • Dependency Security — Version-aware CVE matching against OSV.dev for PyPI, npm, Go, and Packagist ecosystems
  • Manifest Parsing — Auto-detects 11 formats (requirements.txt, package.json, yarn.lock, go.mod, composer.json, and more)
  • Prompt Injection Defense — 9+ detection patterns for instruction override, role hijacking, ChatML injection
  • PII Detection — Email, SSN, credit card, phone, IP — with automatic redaction in findings
  • Secret Detection — AWS keys, GitHub tokens, Stripe keys, JWTs, passwords, connection strings
  • Safety Profiles — 5 built-in profiles (general, education, healthcare, finance, children)
  • Audit Logging — SQLite-backed scan history with finding retrieval and filtering

Install

bash
pip install guardianshield

Quick Start

bash
# Register with Claude Codeclaude mcp add guardianshield -- guardianshield-mcp
# Or run directlyguardianshield-mcp

Editor Integration

bash
# Claude Codeclaude mcp add guardianshield -- guardianshield-mcp
# VS Code (.vscode/mcp.json){"servers": {"guardianshield": {"type": "stdio", "command": "guardianshield-mcp"}}}
# Cursor (.cursor/mcp.json){"mcpServers": {"guardianshield": {"command": "guardianshield-mcp"}}}
# Claude Desktop (claude_desktop_config.json){"mcpServers": {"guardianshield": {"command": "guardianshield-mcp"}}}

MCP Tools

Scanning

ToolDescription
scan_codeScan source code for vulnerabilities and hardcoded secrets
scan_fileScan a single file (auto-detects language from extension)
scan_directoryRecursively scan a directory with filtering and progress streaming
scan_inputCheck user/agent input for prompt injection attempts
scan_outputCheck AI output for PII leaks and content violations
check_secretsDetect hardcoded secrets and credentials
scan_filesScan multiple files in one call
scan_diffParse unified diff and scan only added lines

Dependency Security

ToolDescription
check_dependenciesCheck packages for known CVEs via OSV.dev (PyPI, npm, Go, Packagist)
sync_vulnerabilitiesSync the local OSV vulnerability database
parse_manifestParse any supported manifest file (11 formats) into dependency objects
scan_dependenciesScan a directory for manifest files and check all deps for vulnerabilities

False Positive Management

ToolDescription
mark_false_positiveMark a finding as false positive (flags future matches)
list_false_positivesList active false positive records with optional filter
unmark_false_positiveRemove a false positive record by fingerprint

Engine Management

ToolDescription
list_enginesList available analysis engines with capabilities
set_engineSet active analysis engines for code scanning

Three engines ship built-in: regex (line-by-line pattern matching, enabled by default), deep (cross-line taint tracking), and semantic (structure-aware confidence adjustment).

CI & Developer Workflow

ToolDescription
export_sarifExport findings as SARIF 2.1.0 JSON for GitHub Code Scanning and CI
save_baselineSave current findings as a baseline for delta scanning
scan_with_baselineScan code and report only new findings vs. baseline
check_quality_gateEvaluate findings against severity thresholds (pass/fail/warn)
scan_filesScan multiple files in one call
scan_diffParse unified diff and scan only added lines

Configuration & Utilities

ToolDescription
get_profileGet current safety profile configuration
set_profileSwitch safety profile (general, education, healthcare, finance, children)
test_patternTest a regex pattern against sample code for custom pattern development
audit_logQuery the security audit log
get_findingsRetrieve past findings with filters
shield_statusGet health, configuration, and OSV cache statistics

Configuration

Set environment variables to customize behavior:

VariableDescriptionDefault
GUARDIANSHIELD_PROFILEDefault safety profilegeneral
GUARDIANSHIELD_AUDIT_PATHPath to SQLite audit database~/.guardianshield/audit.db
GUARDIANSHIELD_DEBUGEnable debug logging (1)disabled

Documentation

Full documentation: sparkvibe-io.github.io/GuardianShield

License

Apache 2.0

来源：README.md，提交 0a80a0e

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v1.2.1最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分