memory-poisoning-scanner MCP server

GuardBee MCP

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

Security for AI agents and MCP. GuardBee puts a gateway between your agents and their tools and models that masks personal data and secrets, blocks prompt injection and toxic data flows, asks before risky calls and keeps a tamper-evident audit log, plus scanners that check your code and configs against the OWASP MCP Top 10. Open source (MIT), runs on your machine, no account needed.

# Put your existing MCP servers behind the gateway (backs up your client config first)
npx -y @guardbee/mcp-security-proxy@^1 init --client claude-desktop   # or cursor, claude-code

# Check a codebase against the OWASP MCP Top 10
npx -y @guardbee/mcp-owasp-scan scan . --fail-on=high

_{Run it yourself: `examples/demo` (npm install && npm start).}

Which package should I use?

| You want to… | Install | How | |---|---|---| | Protect agents at runtime: mask personal data, block injection and toxic flows, approve risky calls, keep an audit log | `@guardbee/mcp-security-proxy` | Put it in front of your MCP servers (guardbee-proxy init imports your client config) | | Check a codebase against the OWASP MCP Top 10 in one pass, in CI | `@guardbee/mcp-owasp-scan` | npx @guardbee/mcp-owasp-scan scan . --format=sarif --fail-on=high | | Give an agent many GuardBee checks from one MCP server | `@guardbee/security-suite` | guardbee serve (recommended set), --tools=code,network or all | | Find leaked keys in files, git history or agent transcripts | `@guardbee/mcp-secret-scanner` | npx @guardbee/mcp-secret-scanner scan . --history | | Audit the MCP servers configured on developer machines | `@guardbee/mcp-config-auditor` | npx @guardbee/mcp-config-auditor discover | | Let an agent query a database without seeing raw personal data | `@guardbee/mcp-db-gateway` | Point it at your database with a policy | | Use the detectors in your own code | `@guardbee/guard-core` | import { maskPiiInText } from "@guardbee/guard-core" |

Every other package is a single check (one OWASP risk, one protocol, one file type); each is in security-suite too. npx @guardbee/security-suite list shows them with what they check.

Benchmarks

Detection is measured, not claimed: `packages/pii-bench` is a reproducible benchmark for Turkish and international personal data, with bootstrap 95% intervals and the datasets in the repo.

| Benchmark | Result | |---|---| | Identifiers (TC Kimlik, IBAN, card, phone, e-mail, …), 400 documents + 160 clean | F1 97.1, recall 100%, false alarms on clean documents 8.1%, 0.04 ms per document | | Person names with the optional NER model, same set | F1 99.5 | | Hand-written hard cases for names (tr-names-challenge) | F1 97.1, 0 false alarms | | KVKK Art. 6 special categories with NER (tr-special-challenge) | F1 97.5, 0 false alarms | | Bypass suite: 5 identifiers × 16 disguises (base64, hex, URL/HTML/\u escapes, other scripts' digits, separators) | 80 / 80 masked, 0 of 16 look-alike strings changed |

The identifier detectors were tuned after reading this set's misses, so the challenge sets are the fairer measure; the pii-bench README lists the limits. Any other detector can be run on the same data through its System interface.

Examples

Ready-to-copy proxy policies (minimal, KVKK, coding agent, LLM gateway), client configs for Claude Desktop, Claude Code, Cursor and VS Code, and CI templates for GitHub Actions and GitLab: `examples/`.