GuardianShield

io.github.sparkvibe-io由 GitHub 帳號 sparkvibe-io 發布v1.2.1更新於 Oct 24, 2026

AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs

已驗證STDIO僅桌面開發者工具安全與監控

概覽

AI 產生的概覽

本機 MCP 伺服器，為助理提供安全掃描能力：程式碼漏洞、金鑰、PII、提示注入與相依套件 CVE，並記錄稽核日誌。

可以做什麼
  • 掃描程式碼、單一檔案、目錄、diff 及多個檔案中的漏洞與硬編碼金鑰
  • 檢查使用者輸入中的提示注入，以及 AI 輸出中的 PII 外洩與內容違規
  • 解析相依套件清單並透過 OSV.dev 檢查已知 CVE，同步本機漏洞資料庫
  • 管理誤報紀錄，並選擇分析引擎（正規表達式、跨行汙點追蹤、語意）
  • 匯出 SARIF、儲存基準、執行增量掃描並評估品質閘門，用於 CI
  • 切換安全設定檔，查詢稽核日誌、歷史發現與伺服器狀態
適用情境
適合在助理審查或撰寫程式碼時，讓它標出注入類缺陷、外洩的憑證、PII 或有漏洞的相依套件；也適合需要可重複的 CI 檢查，搭配基準、SARIF 匯出與品質閘門的情境。
執行需求
以 stdio 方式在本機執行，安裝 PyPI 套件 guardianshield（以 pip 安裝，以 guardianshield-mcp 啟動）。可選環境變數 GUARDIANSHIELD_PROFILE、GUARDIANSHIELD_AUDIT_PATH、GUARDIANSHIELD_DEBUG。相依套件檢查會連線 OSV.dev，因此 CVE 查詢需要網路。
安裝前請注意
被掃描的程式碼、發現結果與稽核歷史會寫入 GUARDIANSHIELD_AUDIT_PATH 指定的本機 SQLite 資料庫，請選擇合適路徑。相依套件檢查會把套件名稱與版本傳送給 OSV.dev。發現結果可能包含敏感程式碼片段，誤報紀錄與基準會持續保存並影響後續掃描。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 GuardianShield，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

GuardianShield

[PyPI version] [Python] [License] [Tests]

Universal AI security layer — an open-source MCP server for code scanning, PII detection, prompt injection defense, secret detection, dependency auditing, and audit logging.

Zero dependencies · 27 MCP tools · 5 safety profiles · 108+ detection patterns

Features

  • Code Vulnerability Scanning — SQL injection, XSS, command injection, path traversal with CWE IDs and auto-fix remediation
  • Cross-line Data Flow Analysis — DeepEngine tracks tainted data from sources to sinks across multiple lines using AST-based taint propagation (Python) and regex (JS/TS)
  • Dependency Security — Version-aware CVE matching against OSV.dev for PyPI, npm, Go, and Packagist ecosystems
  • Manifest Parsing — Auto-detects 11 formats (requirements.txt, package.json, yarn.lock, go.mod, composer.json, and more)
  • Prompt Injection Defense — 9+ detection patterns for instruction override, role hijacking, ChatML injection
  • PII Detection — Email, SSN, credit card, phone, IP — with automatic redaction in findings
  • Secret Detection — AWS keys, GitHub tokens, Stripe keys, JWTs, passwords, connection strings
  • Safety Profiles — 5 built-in profiles (general, education, healthcare, finance, children)
  • Audit Logging — SQLite-backed scan history with finding retrieval and filtering

Install

bash
pip install guardianshield

Quick Start

bash
# Register with Claude Codeclaude mcp add guardianshield -- guardianshield-mcp
# Or run directlyguardianshield-mcp

Editor Integration

bash
# Claude Codeclaude mcp add guardianshield -- guardianshield-mcp
# VS Code (.vscode/mcp.json){"servers": {"guardianshield": {"type": "stdio", "command": "guardianshield-mcp"}}}
# Cursor (.cursor/mcp.json){"mcpServers": {"guardianshield": {"command": "guardianshield-mcp"}}}
# Claude Desktop (claude_desktop_config.json){"mcpServers": {"guardianshield": {"command": "guardianshield-mcp"}}}

MCP Tools

Scanning

ToolDescription
scan_codeScan source code for vulnerabilities and hardcoded secrets
scan_fileScan a single file (auto-detects language from extension)
scan_directoryRecursively scan a directory with filtering and progress streaming
scan_inputCheck user/agent input for prompt injection attempts
scan_outputCheck AI output for PII leaks and content violations
check_secretsDetect hardcoded secrets and credentials
scan_filesScan multiple files in one call
scan_diffParse unified diff and scan only added lines

Dependency Security

ToolDescription
check_dependenciesCheck packages for known CVEs via OSV.dev (PyPI, npm, Go, Packagist)
sync_vulnerabilitiesSync the local OSV vulnerability database
parse_manifestParse any supported manifest file (11 formats) into dependency objects
scan_dependenciesScan a directory for manifest files and check all deps for vulnerabilities

False Positive Management

ToolDescription
mark_false_positiveMark a finding as false positive (flags future matches)
list_false_positivesList active false positive records with optional filter
unmark_false_positiveRemove a false positive record by fingerprint

Engine Management

ToolDescription
list_enginesList available analysis engines with capabilities
set_engineSet active analysis engines for code scanning

Three engines ship built-in: regex (line-by-line pattern matching, enabled by default), deep (cross-line taint tracking), and semantic (structure-aware confidence adjustment).

CI & Developer Workflow

ToolDescription
export_sarifExport findings as SARIF 2.1.0 JSON for GitHub Code Scanning and CI
save_baselineSave current findings as a baseline for delta scanning
scan_with_baselineScan code and report only new findings vs. baseline
check_quality_gateEvaluate findings against severity thresholds (pass/fail/warn)
scan_filesScan multiple files in one call
scan_diffParse unified diff and scan only added lines

Configuration & Utilities

ToolDescription
get_profileGet current safety profile configuration
set_profileSwitch safety profile (general, education, healthcare, finance, children)
test_patternTest a regex pattern against sample code for custom pattern development
audit_logQuery the security audit log
get_findingsRetrieve past findings with filters
shield_statusGet health, configuration, and OSV cache statistics

Configuration

Set environment variables to customize behavior:

VariableDescriptionDefault
GUARDIANSHIELD_PROFILEDefault safety profilegeneral
GUARDIANSHIELD_AUDIT_PATHPath to SQLite audit database~/.guardianshield/audit.db
GUARDIANSHIELD_DEBUGEnable debug logging (1)disabled

Documentation

Full documentation: sparkvibe-io.github.io/GuardianShield

License

Apache 2.0

來源：README.md，提交 0a80a0e

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v1.2.1最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分