# SafeGuard MCP server (`@the-safeguard-ai/mcp`)

A [Model Context Protocol](https://modelcontextprotocol.io) server that exposes
SafeGuard AI's **DLP engine**, **Secure AI Gateway**, and **Shadow AI discovery**
as tools any MCP client (Claude Desktop, Cursor, Windsurf, Claude Code, …) can
call. Speaks MCP over **stdio**.

The point: give an AI agent a *governed* way to handle and send data. Before an
agent pastes a chunk of text into some external tool, it can `dlp_scan` it; to
sanitize it, `dlp_redact`; to ask a model with policy + audit enforced, `secure_chat`.

## Tools

| Tool | Needs token? | What it does |
| --- | --- | --- |
| `dlp_scan` | no | Detect PII/secrets in text; returns findings, counts by type, and whether it would be blocked. **Local — no network, no tokens.** |
| `dlp_redact` | no | Return a sanitized copy with `[REDACTED:LABEL]` placeholders. **Local.** |
| `dlp_detectors` | no | List the detector types SafeGuard recognizes (international by default). **Local.** |
| `secure_chat` | yes | Ask an LLM **through the gateway** — inbound redaction, org policy, routing (cloud/self-hosted), audit log. Returns the reply + redaction count. |
| `shadow_ai_report` | yes | Summarize which AI tools the org uses and what data was caught on each. Read-only. |
| `list_policies` | yes | List the org's active DLP policies as enforced by the gateway. Read-only. |

The three local DLP tools mirror `crates/dlp` (the Rust source of truth) and run
entirely in-process — no backend required.

## Configuration (environment)

| Var | Default | Purpose |
| --- | --- | --- |
| `SAFEGUARD_TOKEN` | _(unset)_ | Bearer token: a user **JWT** (sign in to SafeGuard) or an org **API key** (`sg_…`). Required by the gateway/governance tools. |
| `SAFEGUARD_GATEWAY_URL` | `http://localhost:8080` | Secure AI Gateway base URL. |
| `SAFEGUARD_CONTROL_PLANE_URL` | `http://localhost:8081` | Control-plane (governance API) base URL. |
| `SAFEGUARD_MODEL` | `gpt-4o-mini` | Default model id for `secure_chat`. |
| `SAFEGUARD_DEFAULT_ACTION` | `redact` | Default action for the local DLP tools. |

## Run

```bash
# from the repo root
bun run mcp
# or directly
bun run services/mcp/src/index.ts
```

stdout is reserved for the MCP protocol; logs go to stderr.

## Add to an MCP client

Claude Desktop / Cursor / Windsurf (`mcpServers` config):

```json
{
  "mcpServers": {
    "safeguard": {
      "command": "bun",
      "args": ["run", "/absolute/path/to/safeguard-ai/services/mcp/src/index.ts"],
      "env": {
        "SAFEGUARD_TOKEN": "<your JWT or sg_… API key>",
        "SAFEGUARD_GATEWAY_URL": "http://localhost:8080",
        "SAFEGUARD_CONTROL_PLANE_URL": "http://localhost:8081"
      }
    }
  }
}
```

Claude Code:

```bash
claude mcp add safeguard --env SAFEGUARD_TOKEN=<token> \
  -- bun run /absolute/path/to/safeguard-ai/services/mcp/src/index.ts
```

Without `SAFEGUARD_TOKEN` the local DLP tools still work; the gateway and
governance tools return a clear "set SAFEGUARD_TOKEN" message.

## Typecheck

```bash
bun run typecheck
```