Zero-overhead runtime security proxy, reversible secret vault, and audit firewall for Model Context Protocol (MCP) servers.
┌─────────────────────────────────────────────────────────────────────────────┐
│ 🛡️ mcp-shield runtime active: Cursor / Claude Desktop / Windsurf │
├─────────────────────────────────────────────────────────────────────────────┤
│ ➜ IN [BLOCKED] execute_sql "DROP TABLE users;" (Destructive command) │
│ ➜ IN [BLOCKED] read_file "~/.ssh/id_rsa" (Sensitive path protected) │
│ ✔ OUT [MASKED] get_user_api "sk-proj-..." -> [[MCP_SHIELD_REF_8f91]] │
│ ➜ IN [RESTORE] call_webhook [[MCP_SHIELD_REF_8f91]] -> Re-hydrated │
└─────────────────────────────────────────────────────────────────────────────┘When AI assistants (Cursor, Claude Desktop, Windsurf, or agent frameworks) connect to local MCP servers, they often receive unrestricted access to system files, shell commands, and databases.
Unlike offline scanners that only check configuration files once, mcp-shield runs in real time between your AI client and any target MCP server. It intercepts destructive tool calls, prevents sensitive file exfiltration, and redacts credentials before they can leak into external LLM prompts.
Shield your MCP servers across all installed AI editors with a single command:
# Auto-detects and protects Claude Desktop, Cursor, and Windsurf
npx mcp-shield wrap all
# Or target a specific editor:
npx mcp-shield wrap cursor
npx mcp-shield wrap claude
npx mcp-shield wrap windsurfTo revert back at any time:
npx mcp-shield unwrap allRelated MCP server: mcp_Shield
mcp-shield Outperforms Alternative ToolsCapability | Static Config Scanners | Standard Proxies |
|
Real-time Runtime Blocking | ❌ | ✅ | ✅ |
Universal 1-Click Auto-Wrap | ❌ | ❌ | ✅ (Cursor, Claude, Windsurf) |
Reversible Secret Vault | ❌ | ❌ (hard redacts, breaks APIs) | ✅ (masks outbound, re-hydrates inbound) |
Destructive Command Guard | ❌ | Partial | ✅ ( |
Sensitive Path Shield | ❌ | Partial | ✅ ( |
Zero-Corrupt Terminal HUD | ❌ | ❌ | ✅ (Live latency & status to stderr) |
Standard redactors replace secrets with [REDACTED], which breaks downstream APIs when the tool actually needs the token.
mcp-shield uses an in-memory cryptographic token vault:
Outbound to LLM: Replaces raw API keys, JWTs, and passwords with synthetic placeholders ([[MCP_SHIELD_REF_8f91]]). The LLM never sees your real credentials.
Inbound from LLM: When the LLM calls a downstream tool with the placeholder, mcp-shield securely re-hydrates the placeholder with the real secret before dispatching to the target service.
You can also run mcp-shield directly as a transparent wrapper:
# Run any MCP server protected through mcp-shield
npx mcp-shield -- npx -y @modelcontextprotocol/server-postgres "postgresql://localhost/mydb"
# Enable persistent JSON audit logging
npx mcp-shield --log /tmp/audit.jsonl -- npx -y @modelcontextprotocol/server-filesystem /path/to/dirUsage: mcp-shield [options] [command] [args...]
Subcommands:
wrap [target] Inject mcp-shield into AI clients: 'cursor', 'claude', 'windsurf', or 'all' (default: all)
unwrap [target] Restore original configuration
Arguments:
command Target MCP server command (e.g., 'npx', 'node', 'python')
args Arguments to pass to target MCP server
Options:
-l, --log <path> File path to write JSON audit logs
-s, --silent Suppress live terminal HUD to stderr (default: false)
--no-mask Disable automatic secret vault tokenization
-b, --block-tool <tools...> Explicit list of tool names to block completely
-h, --help Display help instructionsgit clone https://github.com/alexfraser-scotch/mcp-shield.git
cd mcp-shield
npm install
npm testContributions, rules, and security suggestions are warmly welcomed! See our Contributing Guide to get started.
Distributed under the MIT License.
This server cannot be deployed
Real-time MCP & A2A prompt-injection, jailbreak, and tool-schema poisoning firewall for AI agents.
An MCP server for Arcjet - the runtime security platform that ships with your AI code.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
