Tripwire Guard

Release candidate: the public npm package has not been published yet. The npx commands below become valid only after https://www.npmjs.com/package/tripwire-guard resolves and a cold-install check passes.

A local, read-only MCP server that inspects untrusted text for prompt-injection before it enters an AI agent's context.

Give it text (a web page, document, email, ticket, RAG chunk) and it returns an allow / review / recommend_block decision with the exact matched evidence. It runs entirely on your machine, makes no network requests, and redacts emails, URLs and credential-like strings by default.

The engine is deterministic and ships with a public 100-case maintainer-authored evaluation — 85% accuracy, with every false positive and false negative published. It is a fast, explainable signal layer; it is not a guarantee of safety, and the host remains responsible for enforcing the decision.

Unlike an MCP proxy, Tripwire Guard does not intercept or authorize other tool calls. Unlike a model-based detector, it needs no model runtime or API. Pair it with least-privilege tools, approval gates, isolation and action-sink enforcement.

Install / run

Requires Node.js 22.12+.

npx tripwire-guard

Related MCP server: guardrails-mcp-server

Use it in an MCP host

{
  "mcpServers": {
    "tripwire": {
      "command": "npx",
      "args": ["-y", "tripwire-guard"]
    }
  }
}

The tool

tripwire_scan (read-only) — inputs:

• content (string, required) — untrusted text to inspect.

• source (string, optional) — provenance, e.g. a page URL, email, tool result, or document name.

• includeEvidence (boolean, optional) — return raw matched evidence instead of redacted. Defaults to redacted.

Returns structured evidence: the decision, a finding count, per-finding rule id / severity / category / matched span, and the engine + ruleset versions.

The npm package is versioned independently from the detector engine reported inside each result. Package 0.4.0 currently ships engine 0.3.0 and ruleset 2026.08.2.

Honest limits

Deterministic heuristics can miss novel, contextual, multilingual, visual, or heavily obfuscated attacks. A clean result means "no known signal matched," not "safe." Pair it with least-privilege tools, approval gates, and sandboxing.

Map the surrounding system

Use the free agent action-path worksheet to map an untrusted input, its reachable tools, the consequential action sink, existing controls, and the minimum safe test evidence. It is ungated and contains a clearly labelled synthetic example.

More

Live demo, full benchmark, threat model, and fixed-scope team review: https://tripwire-live.netlify.app

Source and security boundary

This repository contains the distributable MIT-licensed, read-only Guard MCP server and its release metadata. The broader Tripwire browser product and paid review materials are maintained separately. Report package defects through this repository's issue tracker; do not post secrets, customer data, private prompts, or live credentials.

© 2026 Kuba Opoczka.