Skip to main content
Glama
the-safeguard-ai

safeguard-mcp

by the-safeguard-ai
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

SafeGuard MCP server (@the-safeguard-ai/mcp)

A Model Context Protocol server that exposes SafeGuard AI's DLP engine, Secure AI Gateway, and Shadow AI discovery as tools any MCP client (Claude Desktop, Cursor, Windsurf, Claude Code, …) can call. Speaks MCP over stdio.

The point: give an AI agent a governed way to handle and send data. Before an agent pastes a chunk of text into some external tool, it can dlp_scan it; to sanitize it, dlp_redact; to ask a model with policy + audit enforced, secure_chat.

Tools

Tool

Needs token?

What it does

dlp_scan

no

Detect PII/secrets in text; returns findings, counts by type, and whether it would be blocked. Local — no network, no tokens.

dlp_redact

no

Return a sanitized copy with [REDACTED:LABEL] placeholders. Local.

dlp_detectors

no

List the detector types SafeGuard recognizes (international by default). Local.

secure_chat

yes

Ask an LLM through the gateway — inbound redaction, org policy, routing (cloud/self-hosted), audit log. Returns the reply + redaction count.

shadow_ai_report

yes

Summarize which AI tools the org uses and what data was caught on each. Read-only.

list_policies

yes

List the org's active DLP policies as enforced by the gateway. Read-only.

The three local DLP tools mirror crates/dlp (the Rust source of truth) and run entirely in-process — no backend required.

Related MCP server: Blekline MCP Server

Configuration (environment)

Var

Default

Purpose

SAFEGUARD_TOKEN

(unset)

Bearer token: a user JWT (sign in to SafeGuard) or an org API key (sg_…). Required by the gateway/governance tools.

SAFEGUARD_GATEWAY_URL

http://localhost:8080

Secure AI Gateway base URL.

SAFEGUARD_CONTROL_PLANE_URL

http://localhost:8081

Control-plane (governance API) base URL.

SAFEGUARD_MODEL

gpt-4o-mini

Default model id for secure_chat.

SAFEGUARD_DEFAULT_ACTION

redact

Default action for the local DLP tools.

Run

# from the repo root
bun run mcp
# or directly
bun run services/mcp/src/index.ts

stdout is reserved for the MCP protocol; logs go to stderr.

Add to an MCP client

Claude Desktop / Cursor / Windsurf (mcpServers config):

{
  "mcpServers": {
    "safeguard": {
      "command": "bun",
      "args": ["run", "/absolute/path/to/safeguard-ai/services/mcp/src/index.ts"],
      "env": {
        "SAFEGUARD_TOKEN": "<your JWT or sg_… API key>",
        "SAFEGUARD_GATEWAY_URL": "http://localhost:8080",
        "SAFEGUARD_CONTROL_PLANE_URL": "http://localhost:8081"
      }
    }
  }
}

Claude Code:

claude mcp add safeguard --env SAFEGUARD_TOKEN=<token> \
  -- bun run /absolute/path/to/safeguard-ai/services/mcp/src/index.ts

Without SAFEGUARD_TOKEN the local DLP tools still work; the gateway and governance tools return a clear "set SAFEGUARD_TOKEN" message.

Typecheck

bun run typecheck

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityStale
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • Shrike Security MCP Server

    Shrike-Security
    A
    license
    A
    quality
    B
    maintenance
    Protects AI agents from threats like prompt injection, jailbreaks, and SQL injection through a multi-layer scanning pipeline. It also enables PII redaction and rehydration to ensure data privacy during LLM interactions.
    12
    125 npm
    2
    Apache 2.0
  • Blekline MCP Server by Blekline

    Blekline MCP Serverofficial

    Blekline
    A
    license
    A
    quality
    A
    maintenance
    Provides AI ingress governance by masking prompts, classifying risk, and enforcing tool policies before agent calls reach model providers or sandboxes.
    6
    1
    AGPL 3.0

  • Security Guard MCP

    marcojourney
    F
    license
    Not graded
    quality
    D
    maintenance
    Enables secure interaction between LLMs and MCP tools by applying zero-trust security controls, including sensitive data masking, file system protection, and policy enforcement.
    -

  • mcp-dlp

    aaravjain151
    F
    license
    A
    quality
    C
    maintenance
    A data-loss-prevention (DLP) layer for AI agents that intercepts document reads, scans for sensitive data, and redacts or blocks it before it reaches the model, with audit logging.
    1
    -