GuardRail MCP v2.0 is a hybrid multi-language security analysis server for scanning source code, infrastructure-as-code, dependencies, and containers for secrets, vulnerabilities, and misconfigurations — with enterprise features like RBAC, policy gates, and audit logging.

Core Security Scanning

• audit_code_safety – Multi-engine scan (secrets regex, Python AST + taint, tree-sitter, custom rules) returning redacted issues, risk scores, and verdicts

• audit_infra_security – IaC misconfiguration detection with optional budget gate on estimated monthly cloud spend

• audit_container_config – Security heuristics for Dockerfile/Kubernetes configs

• audit_cloud_cost – Rough AWS/GCP monthly cost estimates from IaC text

Repository & Git Scanning

• scan_repository – Recursive parallel repo scan with optional incremental caching (up to 2000 files)

• scan_git_diff – Scan only files changed in a git range or staged changes

Dependency & Supply Chain

• scan_dependencies – Dependency inventory with optional OSV CVE queries, pip audit, or npm audit

• generate_sbom – Generate CycloneDX and/or SPDX SBOM JSON

Reporting & Export

• export_sarif – Convert findings to SARIF 2.1.0 JSON

• suggest_fixes – Template or LLM-assisted fix drafts (never auto-applied)

• security_score – Compute a security score/grade from an issues list with optional history recording

• compliance_report – Generate lightweight compliance evidence reports for auditors

• full_pipeline – Combined repo/diff scan + dependency check + fix suggestions + SARIF + SBOM in one call

Engine & Plugin Management

• engine_status – Report hybrid engine capabilities (supported languages, active plugins)

• list_plugins – List loaded plugins and custom rule counts

History & Dashboard

• scan_history – Retrieve recent scan history from local SQLite storage

Enterprise Features

• enterprise_health – Check health, metrics, and non-secret config status

• enterprise_policy_status – View active policy packs and gate thresholds for the calling tenant

• evaluate_policy – Run a policy pack evaluation against a prior scan result

• list_audit_events – List recent in-memory audit events (operator+ role required)

• issue_access_token – Issue short-lived JWTs for RBAC roles (admin only)

• reload_enterprise_config – Reload enterprise YAML/JSON config from disk (admin)

• manage_tenant – Inspect or update in-memory tenant quota counters (admin)

Provides tools for auditing container configurations and security checks for Docker and Kubernetes deployments.

Allows scanning of git diffs and repositories for security vulnerabilities.

Integrates with GitHub code scanning by uploading SARIF results and can be run in GitHub Actions CI.

Exposes metrics in Prometheus format for monitoring the MCP server.

1. Click on "Install Server".

2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.

3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@GuardRail MCP v2.0 (Enterprise) scan my repository for security vulnerabilities and generate SARIF report"

That's it! The server will respond to your query, and you can continue using it as needed.

Here is a step-by-step guide with screenshots.