Security Suite

@guardbee/security-suite

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

Every GuardBee MCP security tool from one install. guardbee serve is one MCP server with the tools of the packages you pick; guardbee <package> … runs any package's CLI. 30 packages, 129 MCP tools.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Quick start

{  "mcpServers": {    "guardbee": {      "command": "npx",      "args": ["-y", "@guardbee/security-suite", "serve"]    }  }}

That serves the recommended set (31 tools): a one-pass OWASP MCP Top 10 scan, secrets, prompt injection, toxic flows, MCP client configs and dependency CVEs. Pick others with --tools:

"args": ["-y", "@guardbee/security-suite", "serve", "--tools=recommended,network"]

--tools takes group names and package ids, comma-separated, or all (129 tools; some clients cap the number of tools, Cursor among them). GUARDBEE_SUITE_TOOLS does the same as an environment variable. Each tool's name starts with its package's prefix, so two packages' scan_text tools do not collide: secrets_scan_text, injection_scan_text. Names that already say it stay as they are (owasp_scan_path, inspect_ssl).

Groups

Packages

guardbee list prints this table. The proxy (mcp-security-proxy) and the database gateway (mcp-db-gateway) are not in the suite: they sit in front of other servers rather than answering tool calls.

CLI

npm install -g @guardbee/security-suite
guardbee list                                         # packages and groupsguardbee owasp-scan scan . --fail-on=high --format=sarif > owasp.sarifguardbee secret-scanner scan . --history              # any package's CLI, same argumentsguardbee mcp-config-auditor discover

The shortcuts from earlier versions still work:

GitHub Actions

- run: npx -y @guardbee/security-suite owasp-scan scan . --format=sarif --fail-on=high > owasp.sarif- run: npx -y @guardbee/security-suite dep-audit . --fail-on=high- uses: github/codeql-action/upload-sarif@v3  if: always()  with:    sarif_file: owasp.sarif

Upgrading from 0.2

guardbee serve used to expose five tools from four packages with plain names (scan_directory, scan_file, audit_dependencies, inspect_ssl, check_dns). It now serves the recommended group with prefixed names: the same checks are secrets_scan_directory, secrets_scan_file, deps_audit_directory, and, with --tools=recommended,network, inspect_ssl and enumerate_dns / dns_check_email_security. Agents that call tools by name need the new names.

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.