security

A local firewall for MCP tool calls

mcp-guard sits locally on stdio between client and tools. It logs calls with argument names only, flags poisoned descriptions, and blocks rule violations in enforce mode.