Code Guard MCP runs on your own machine — the client starts it, so there is no endpoint to ping. 87 installs a week from npm. Last commit 1 Nov 2026.
Security scan for AI-generated code: injection, SSRF, secrets, weak crypto, unsafe deserialization.
We read the source, 20 h ago · rules 995398eba69f
Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.
const r = spawnSync(comspec, ['/d', '/s', '/c', line], {
out.innerHTML = head + "\n\n" + JSON.stringify(j,null,2);
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
Today is the operative word: we check Code Guard MCP every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add code-guard-mcp -- npx -y @mlawsonking/code-guard-mcp
{
"mcpServers": {
"code-guard-mcp": {
"command": "npx",
"args": [
"-y",
"@mlawsonking/code-guard-mcp"
]
}
}
}
[mcp_servers.code-guard-mcp]
command = "npx"
args = ["-y", "@mlawsonking/code-guard-mcp"]
{
"mcpServers": {
"code-guard-mcp": {
"command": "npx",
"args": [
"-y",
"@mlawsonking/code-guard-mcp"
]
}
}
}
{
"servers": {
"code-guard-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@mlawsonking/code-guard-mcp"
]
}
}
}
AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs
Scans code for insecure LLM/AI integration: exposed keys, unsafe output, prompt injection
Scans code for insecure LLM/AI integration: exposed keys, unsafe output, prompt injection
Code security scanner for founders and small teams: leaked secrets, missing RLS, injection, CVEs
Security audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV.
Local-first MCP security scanner and CLI for AI-generated applications.
Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
Offline security scanning for AI-generated code: seven open-source scanners in one MCP server.
Answers built from our own checks of this server.