https://github.com/diomonogatari/mcp-guard
Roslyn analyzer that flags MCP tool-poisoning in your C# servers before it ships.
https://github.com/diomonogatari/mcp-guard
csharp dotnet mcp prompt-injection roslyn roslyn-analyzer security static-analysis
Last synced: about 1 month ago
JSON representation
Roslyn analyzer that flags MCP tool-poisoning in your C# servers before it ships.
- Host: GitHub
- URL: https://github.com/diomonogatari/mcp-guard
- Owner: diomonogatari
- License: mit
- Created: 2026-06-05T20:43:56.000Z (about 1 month ago)
- Default Branch: main
- Last Pushed: 2026-06-05T22:42:36.000Z (about 1 month ago)
- Last Synced: 2026-06-05T23:03:56.777Z (about 1 month ago)
- Topics: csharp, dotnet, mcp, prompt-injection, roslyn, roslyn-analyzer, security, static-analysis
- Language: C#
- Homepage:
- Size: 0 Bytes
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
Awesome Lists containing this project
README
# mcp-guard
**A Roslyn analyzer that catches prompt-injection and tool-poisoning in your C# MCP server's tool descriptions — at build time, before they ship.**
[](https://github.com/diomonogatari/mcp-guard/actions/workflows/ci.yml)
`mcp-guard` is a `DiagnosticAnalyzer` for .NET projects that build [Model Context
Protocol](https://modelcontextprotocol.io) servers with the official
[C# SDK](https://github.com/modelcontextprotocol/csharp-sdk). It scans the strings an LLM reads as
**instructions** — the `[Description(...)]` on `[McpServerTool]` methods, their parameters, and tool
types — and flags prompt-injection / tool-poisoning patterns as IDE squiggles and build warnings.
> It is **not** an MCP server. It is static analysis that *protects* MCP servers. See the
> [threat model](docs/THREAT-MODEL.md) for why tool descriptions are attack surface.
## Rules
| Rule | Summary | Severity |
|------|---------|----------|
| [`MCPG001`](docs/rules/MCPG001.md) | Instruction-style / prompt-injection phrasing in a description | Warning |
| [`MCPG002`](docs/rules/MCPG002.md) | Hidden / non-printable Unicode (zero-width, bidi, BOM, tag chars) | Warning |
| [`MCPG003`](docs/rules/MCPG003.md) | A sensitive credential / secret-file reference (`~/.ssh/id_rsa`, `.aws/credentials`, …) | Warning |
| [`MCPG004`](docs/rules/MCPG004.md) | A data-exfiltration directive (transmit verb + external destination + sensitive/covert cue) | Warning |
Precision is the priority: mcp-guard only inspects descriptions on the **MCP tool surface**
(`[McpServerTool]` methods, their parameters, and `[McpServerToolType]` types), so ordinary
`[Description]` usage never false-positives. The [roadmap](docs/ROADMAP.md) tracks the rules still to
come on the path to 1.0.
## Install
```xml
```
`PrivateAssets="all"` keeps the analyzer from flowing to your package's consumers — it runs at *your*
build time. The analyzer targets `netstandard2.0`, so it loads in every IDE and build host; it is
verified against projects targeting **.NET 8** and **.NET 10**.
## Configuration
Tune severity per rule via `.editorconfig` — e.g. to gate the build on findings:
```ini
dotnet_diagnostic.MCPG001.severity = error
```
Inline suppression (`#pragma warning disable MCPG001`) is supported, but suppressing a security rule
should be rare — prefer rewording the description.
## Documentation
- [Threat model](docs/THREAT-MODEL.md) — why descriptions are attack surface, and the static-vs-runtime scope
- [Architecture](docs/ARCHITECTURE.md) — how the analyzer works
- [Roadmap](docs/ROADMAP.md) — the rule backlog on the path to 1.0
- [Rule reference](docs/rules/) — one page per `MCPGxxx`
- [Contributing](CONTRIBUTING.md) — build, test, and add a rule
- [Security policy](SECURITY.md)
## License
[MIT](LICENSE) © Diogo Carvalho