Laraguard MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_BASE_PATH | No | Single allowed root path for project scanning. | |
| MCP_MAX_FILES | No | Maximum number of files to enumerate per scan. | 5000 |
| MCP_BASE_PATHS | No | Comma-separated list of allowed root paths. Takes precedence over MCP_BASE_PATH. | |
| MCP_TIMEOUT_SECONDS | No | Logical timeout for audit operations. | 30 |
| MCP_MAX_FILE_SIZE_BYTES | No | Maximum file size (in bytes) to read per file. | 300000 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| project_infoA | Return metadata for a Laravel project: composer constraints, framework detection, PHP version. |
| dependency_auditA | Audit Composer dependencies against the OSV.dev vulnerability advisory database. Parses composer.lock and reports CVEs with severity and fix versions. |
| config_auditC | Audit risky Laravel environment and configuration settings: APP_DEBUG, APP_ENV, APP_KEY, SESSION_SECURE_COOKIE, and CORS wildcard origins. |
| code_scanA | Run static pattern analysis across all PHP source files. Detects SQL injection, RCE risks (eval/shell_exec/exec/system), unsafe unserialize, hardcoded credentials, weak cryptography (MD5/SHA1), mass assignment, path traversal, and LFI risks. |
| blade_scanA | Scan Laravel Blade templates in resources/views/ for XSS vulnerabilities. Detects unescaped output ({!! !!}), raw user input rendering, and unsafe PHP echo in templates. |
| route_auditA | Audit Laravel route files (routes/web.php, routes/api.php) for security misconfigurations. Detects admin routes without auth middleware, API routes without authentication, login routes without throttle, and CSRF exception wildcards in VerifyCsrfToken. |
| attack_simulateA | Run active HTTP security probes against a running Laravel application. Probes: error/debug disclosure, SQL injection on /login, reflected XSS, CSRF enforcement, auth bypass on /api/user, and brute-force rate limiting. WARNING: only use against local or staging environments — never production. |
| full_auditA | Run all static audits in parallel: dependency CVE check (OSV.dev), environment config, PHP code scan, Blade XSS scan, and route/middleware audit. Returns a single consolidated report with per-section summaries. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool has a clearly distinct purpose with no overlap: attack_simulate runs active probes, blade_scan focuses on Blade templates, code_scan analyzes PHP source, config_audit checks environment settings, dependency_audit reviews Composer dependencies, full_audit consolidates other audits, project_info provides metadata, and route_audit examines route configurations. The descriptions explicitly differentiate their scopes, eliminating any ambiguity.
All tool names follow a consistent snake_case pattern with clear verb_noun structures: attack_simulate, blade_scan, code_scan, config_audit, dependency_audit, full_audit, project_info, and route_audit. The naming is predictable and readable throughout, with no deviations in style or convention.
With 8 tools, the set is well-scoped for Laravel security auditing, covering active testing, static analysis, dependency checks, configuration reviews, and metadata. Each tool earns its place by addressing a specific aspect of security, avoiding redundancy while providing comprehensive coverage for the domain.
The tool surface offers complete coverage for Laravel security auditing: it includes active simulation (attack_simulate), static analysis (code_scan, blade_scan), configuration auditing (config_audit, route_audit), dependency management (dependency_audit), a consolidated audit option (full_audit), and project metadata (project_info). There are no obvious gaps, and the tools support a full security assessment workflow from start to finish.