mcp-armor MCP Server

by studiomeyer Your server? Claim it

local only

mcp-armor runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 2 Nov 2026.

Security sidecar for MCP servers: 11 read-only control-plane tools for prompt-injection checks.

—

Installs / week

not published

Stars

0 open issues

2 Nov 2026

Last commit

from GitHub

MIT

License

Rust

What the code does

We read the source, 22 h ago · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Touches key and credential files src/scanner/tool_poison.rs:191, src/scanner/regex_stage.rs:99

                r"(?i)\b(read|cat|open|fetch|load|access|retrieve|include|grab|dump|copy)\b[^\n]{0,70}(~/\.ssh|id_rsa|id_ed25519|id_ecdsa|\.env\b|/etc/passwd|/etc/shadow|\.aws/credentials|\.aws/config|\.npmrc|\.git-credentials|mcp\.json|secret[_ ]?key|api[_-]?key|private[_ ]key|a…

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Alternatives to mcp-armor

same job, measured the same way

AIShield Security Scanner

by lm203688

Scans MCP servers for tool poisoning, prompt injection and supply chain risks.

77 installs/wk 10 tools local only

Power Strip Security

by albertbalestrini

Prompt-injection shield for agents: read pages, scan content, audit MCP servers and skills. x402.

328 installs/wk 4 tools answering

IA-QA Security — 30 tools

by jcjamet

Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free.

30 tools answering

Mcpshield

by mcpshield-dev

Security scanner for MCP servers - detects tool poisoning and injection

43 installs/wk local only

Zn Gate

by usezn

The local security layer for coding agents: secret redaction, injection checks and an MCP proxy.

1 483 installs/wk local only

ProdForge

by cloudcorprecords

Connects MCP servers, packages, security checks, and release gates in one repo.

270 installs/wk local only

Mund — MCP Security Scanner

by tyox-all

Scan for prompt injection, secrets, PII, and vet MCP servers before installation

94 installs/wk local only

MCP Safeguard

by cognivators

MCP server security scanner: detects prompt injection, credential leaks, SSRF, tool poisoning.

195 installs/wk local only

mcp-armor — questions

Answers built from our own checks of this server.

Why is there no uptime for mcp-armor?

mcp-armor runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone.

Is mcp-armor open source?

Yes — it is published under the MIT licence, written in Rust and 1 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.