K-Guard MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| K_GUARD_MCP_MAX_MB | No | Maximum total file size in MB per MCP call. Default: 10. | |
| K_GUARD_MCP_MAX_FILES | No | Maximum number of files to scan per MCP call. Default: 1000. | |
| K_GUARD_MCP_MAX_TEXT_MB | No | Maximum text size in MB per MCP call. Default: 1. | |
| K_GUARD_MCP_ENABLE_PROBE | No | Set to '1' to enable the probe_http MCP tool (disabled by default). | |
| K_GUARD_MCP_MAX_ARG_CHARS | No | Maximum argument character count per MCP call. Default: 4096. | |
| K_GUARD_MCP_ENABLE_SESSION_PROBE | No | Set to '1' to enable authenticated read-only probing through MCP, which also requires a short-lived, origin-bound session file. | |
| K_GUARD_MCP_GUARDIAN_MAX_TARGETS | No | Maximum number of Guardian manifest targets per MCP call. Default: 100. | |
| K_GUARD_MCP_ENABLE_EXTERNAL_PROBE | No | Set to '1' to enable authorized external probing through MCP. | |
| K_GUARD_MCP_GUARDIAN_MAX_REQUESTS | No | Maximum number of Guardian HTTP requests per MCP call. Default: 200. | |
| K_GUARD_MCP_EXTERNAL_ALLOWED_HOSTS | No | Comma-separated list of allowed external hosts for external probing, e.g. 'example.com,staging.example.com'. | |
| K_GUARD_MCP_ENABLE_DEEP_ACTIVE_PROBE | No | Set to '1' to enable bounded deep active probing through MCP. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| check_my_appB | Review the complete bound workspace; poll with continue_review until terminal. |
| continue_reviewA | Wait briefly for a long review; repeat until state is completed or failed. |
| start_review_before_shipD | Start Guardian high only after a completed first review of the same source snapshot. |
| scan_workspaceB | Scan a local workspace for secrets, Korean PII, composite PII, config risks, and flow risks. |
| scan_textB | Scan an inline text snippet without writing it to disk. |
| scan_diffB | Scan only a git diff, without echoing raw diff content in the MCP response. |
| scan_mcp_configC | Discover and scan project MCP configs plus agent instruction and skill components. |
| probe_httpC | Run safe read-only HTTP probes against localhost or explicitly authorized external targets. |
| build_flow_mapC | Build an EXPERIMENTAL heuristic data-flow risk map for source and sink patterns. |
| observe_mcp_eventsB | Observe MCP runtime/proxy JSONL events for PII, hidden instructions, and agentic/external flow. |
| enforce_mcp_eventsC | Evaluate MCP runtime block/redact policy and return a raw-free report-only interceptor result. |
| observe_mcp_eventC | Observe one MCP runtime event and return stream-ready block/redact policy decisions. |
| score_fixture_corpusB | Evaluate a local fixture corpus and return FP/FN precision/recall scoreboard. |
| deep_analyzer_auditC | Run the local fail-closed Semgrep deep profile; this is intrafile evidence, not an authorization proof. |
| validate_multilang_packC | Run the pinned nine-language pack twice; this does not claim field accuracy. |
| software_composition_auditB | Audit Python/npm/Go locks; explicit authorization is required because engines may consult advisory databases. |
| validate_policy_controlsC | Run the repeated synthetic JIT/JEA and database AST/RBAC/isolation control pack. |
| validate_streamable_http_runtimeD | Run the repeated Streamable HTTP authorization, lifecycle, SSE, and audit matrix. |
| data_release_gateC | Run the strict data shipment gate over Guardian, validation, Korean corpus, and MCP interceptor evidence. |
| create_field_campaign_templateC | Create the empty 12-20 app owned/partner roster used before holdout preregistration. |
| field_campaign_statusC | Validate the app roster and emit a raw-free fail-closed campaign status. |
| create_benchmark_templateC | Create a 20/20/10 field benchmark manifest CSV template. |
| field_benchmarkC | Aggregate field benchmark reports by cohort; probes require explicit MCP probe opt-in. |
| create_guardian_manifest_templateC | Create a korean_senior Guardian manifest for four-domain pre-release reviews. |
| guardian_auditC | Run Guardian; korean_senior rows require four review domains and fail closed when fail_on is set. |
| explain_ruleB | Explain a K-Guard rule in plain language with impact, fix steps, and verification. |
| suggest_fixC | Return a dry-run fix recipe and regression-test suggestions for a rule. |
| security_gateC | Run the quick workspace gate. Use guardian_audit(fail_on=...) for the canonical release gate. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| guided_review | 빠른 확인부터 엄격한 Guardian 출하 판정까지 안내합니다. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 28 tools
Most tools have clearly distinct purposes with detailed descriptions. However, a few near-duplicates exist (e.g., observe_mcp_event vs observe_mcp_events, security_gate vs guardian_audit) that could slightly confuse an agent. Overall, the set is well-separated.
Tool names mix conventions inconsistently. Many follow verb_noun (scan_workspace, create_field_campaign_template, explain_rule), but several use noun_noun (software_composition_audit, data_release_gate, field_campaign_status, security_gate). There is also singular/plural inconsistency (observe_mcp_event vs observe_mcp_events). This makes naming patterns unpredictable.
With 28 tools, this exceeds the 25+ threshold and feels heavy. While the domain is broad, many tools overlap in function (multiple validation and audit tools). The server could consolidate some related tools (e.g., separate scan_* tools) without losing clarity.
The tool surface covers the main security workflow: scanning, validation, audits, templates, explanations, fixes, and status gates. Minor gaps exist (e.g., no explicit rule management or history retrieval), but the core lifecycle is present and agents can complete typical tasks.