{"id":50606881,"url":"https://github.com/diomonogatari/mcp-guard","last_synced_at":"2026-06-06T00:02:17.790Z","repository":{"id":362781338,"uuid":"1260751147","full_name":"diomonogatari/mcp-guard","owner":"diomonogatari","description":"Roslyn analyzer that flags MCP tool-poisoning in your C# servers before it ships.","archived":false,"fork":false,"pushed_at":"2026-06-05T22:42:36.000Z","size":0,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-05T23:03:56.777Z","etag":null,"topics":["csharp","dotnet","mcp","prompt-injection","roslyn","roslyn-analyzer","security","static-analysis"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/diomonogatari.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-05T20:43:56.000Z","updated_at":"2026-06-05T22:43:37.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/diomonogatari/mcp-guard","commit_stats":null,"previous_names":["diomonogatari/mcp-guard"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/diomonogatari/mcp-guard","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/diomonogatari%2Fmcp-guard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/diomonogatari%2Fmcp-guard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/diomonogatari%2Fmcp-guard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/diomonogatari%2Fmcp-guard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/diomonogatari","download_url":"https://codeload.github.com/diomonogatari/mcp-guard/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/diomonogatari%2Fmcp-guard/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33964367,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-05T02:00:06.157Z","response_time":120,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["csharp","dotnet","mcp","prompt-injection","roslyn","roslyn-analyzer","security","static-analysis"],"created_at":"2026-06-06T00:02:13.966Z","updated_at":"2026-06-06T00:02:17.783Z","avatar_url":"https://github.com/diomonogatari.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mcp-guard\r\n\r\n**A Roslyn analyzer that catches prompt-injection and tool-poisoning in your C# MCP server's tool descriptions — at build time, before they ship.**\r\n\r\n[![CI](https://github.com/diomonogatari/mcp-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/diomonogatari/mcp-guard/actions/workflows/ci.yml)\r\n\r\n`mcp-guard` is a `DiagnosticAnalyzer` for .NET projects that build [Model Context\r\nProtocol](https://modelcontextprotocol.io) servers with the official\r\n[C# SDK](https://github.com/modelcontextprotocol/csharp-sdk). It scans the strings an LLM reads as\r\n**instructions** — the `[Description(...)]` on `[McpServerTool]` methods, their parameters, and tool\r\ntypes — and flags prompt-injection / tool-poisoning patterns as IDE squiggles and build warnings.\r\n\r\n\u003e It is **not** an MCP server. It is static analysis that *protects* MCP servers. See the\r\n\u003e [threat model](docs/THREAT-MODEL.md) for why tool descriptions are attack surface.\r\n\r\n## Rules\r\n\r\n| Rule | Summary | Severity |\r\n|------|---------|----------|\r\n| [`MCPG001`](docs/rules/MCPG001.md) | Instruction-style / prompt-injection phrasing in a description | Warning |\r\n| [`MCPG002`](docs/rules/MCPG002.md) | Hidden / non-printable Unicode (zero-width, bidi, BOM, tag chars) | Warning |\r\n| [`MCPG003`](docs/rules/MCPG003.md) | A sensitive credential / secret-file reference (`~/.ssh/id_rsa`, `.aws/credentials`, …) | Warning |\r\n| [`MCPG004`](docs/rules/MCPG004.md) | A data-exfiltration directive (transmit verb + external destination + sensitive/covert cue) | Warning |\r\n\r\nPrecision is the priority: mcp-guard only inspects descriptions on the **MCP tool surface**\r\n(`[McpServerTool]` methods, their parameters, and `[McpServerToolType]` types), so ordinary\r\n`[Description]` usage never false-positives. The [roadmap](docs/ROADMAP.md) tracks the rules still to\r\ncome on the path to 1.0.\r\n\r\n## Install\r\n\r\n```xml\r\n\u003cItemGroup\u003e\r\n  \u003cPackageReference Include=\"McpGuard.Analyzers\" Version=\"0.1.0\" PrivateAssets=\"all\" /\u003e\r\n\u003c/ItemGroup\u003e\r\n```\r\n\r\n`PrivateAssets=\"all\"` keeps the analyzer from flowing to your package's consumers — it runs at *your*\r\nbuild time. The analyzer targets `netstandard2.0`, so it loads in every IDE and build host; it is\r\nverified against projects targeting **.NET 8** and **.NET 10**.\r\n\r\n## Configuration\r\n\r\nTune severity per rule via `.editorconfig` — e.g. to gate the build on findings:\r\n\r\n```ini\r\ndotnet_diagnostic.MCPG001.severity = error\r\n```\r\n\r\nInline suppression (`#pragma warning disable MCPG001`) is supported, but suppressing a security rule\r\nshould be rare — prefer rewording the description.\r\n\r\n## Documentation\r\n\r\n- [Threat model](docs/THREAT-MODEL.md) — why descriptions are attack surface, and the static-vs-runtime scope\r\n- [Architecture](docs/ARCHITECTURE.md) — how the analyzer works\r\n- [Roadmap](docs/ROADMAP.md) — the rule backlog on the path to 1.0\r\n- [Rule reference](docs/rules/) — one page per `MCPGxxx`\r\n- [Contributing](CONTRIBUTING.md) — build, test, and add a rule\r\n- [Security policy](SECURITY.md)\r\n\r\n## License\r\n\r\n[MIT](LICENSE) © Diogo Carvalho\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdiomonogatari%2Fmcp-guard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdiomonogatari%2Fmcp-guard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdiomonogatari%2Fmcp-guard/lists"}