mcp-guard is a security and network MCP server providing local hardware access, network analysis, forensics, and supply chain auditing — capabilities impossible for remote/cloud services.

Local Hardware & System Tools

• Wi-Fi scan — Nearby networks (SSID, BSSID, signal, channel, security type)

• Bluetooth scan — Nearby devices (name, address, type, pairing status)

• USB devices — All connected USB devices (vendor, product ID, speed, manufacturer)

• System info — CPU, RAM, disk, uptime, network interfaces with IPs/MACs

• Process list — Running processes with CPU% and memory, filterable by name

• Open files — All files, sockets, and pipes open by processes (via lsof)

• Network connections — Live TCP connections (like netstat)

• File watch — Real-time kernel-level FS events (create, write, delete, rename)

Network Discovery & Scanning

• ARP scan — Layer 2 LAN discovery (IP, MAC, hostname, vendor; finds hosts blocking ICMP/TCP)

• Ping sweep — ICMP host discovery across a CIDR range

• Port scan — Concurrent TCP port scanner with service name lookup

• Traceroute — Hop-by-hop network path tracing via ICMP TTL probes

• Banner grab — Raw TCP banners from any protocol (SSH, FTP, SMTP, Redis, etc.)

Security Auditing & Forensics

• Secret scan — Find hardcoded credentials (20+ patterns: AWS, GitHub, OpenAI, Stripe, private keys, DB URLs, etc.)

• Hash files — SHA-256 hashes of all files in a directory for integrity baselines

• Critical file monitor — Track unauthorized changes to SSH keys, /etc/hosts, sudoers, shell profiles (scan/baseline/diff modes)

• Persistence scan — Detect malware persistence: LaunchAgents/Daemons (macOS), systemd units (Linux), cron jobs, shell profile injections

• Supply chain audit — Audit node_modules for dangerous lifecycle scripts, typosquatting (Levenshtein distance vs. 50+ popular packages), and runtime eval()

Network & Web Utilities

• SSL inspect — Full TLS certificate chain (expiry, issuer, SANs, key size, weak-config warnings)

• DNS enumeration — A, AAAA, MX, NS, TXT, CNAME records; detects missing SPF/DMARC

• HTTP header audit — Security headers scored 0–100 with a letter grade

• CVE check — npm dependencies checked against the OSV vulnerability database (no API key needed)

• JWT decode — Locally decode JWTs (algorithm, expiry, security warnings)

Scans for exposed GitHub tokens and secrets.

Identifies open MySQL ports and services on target hosts via TCP port scanning.

Checks npm dependencies for known vulnerabilities using the OSV database.

Scans for hardcoded OpenAI API keys.

Identifies open Redis ports and services on target hosts via TCP port scanning.

Scans for exposed SendGrid API keys.

Scans for exposed Slack tokens.

Scans for exposed Stripe API keys and secrets.

Scans for exposed Twilio credentials.

1. Click on "Install Server".

2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.

3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-guard audit HTTP security headers on https://example.com"

That's it! The server will respond to your query, and you can continue using it as needed.

Here is a step-by-step guide with screenshots.