Mcpguard MCP Server

Credential management replacing plaintext API keys with secure vault references.

Data last scanned today · Reviewed today

24★ 4TypeScriptMIT

Overview

Mcpguard acts as a local security layer for your MCP environment by scanning configuration files for exposed, plaintext API keys. It migrates these credentials into your operating system's native keychain, ensuring sensitive secrets are never written to disk in plain text. Once migrated, the tool replaces your configuration values with secure internal references. It then handles credential injection at runtime, allowing your AI agents to function while keeping authentication tokens safely encrypted within your local system vault.

Our verdict

This tool carries a high-risk score of 24/100, primarily due to its community-maintained status and lack of editorial review. As a single-contributor project with no official vendor backing, users should be aware of the supply-chain risks involved in installing third-party utilities that handle authentication credentials. It is best suited for security-conscious developers comfortable auditing the TypeScript source code before deployment.

Uses OS keychain for encrypted credential storage
Small dependency footprint with only six direct packages
Provides automated auditing of existing configuration files

High-risk score due to lack of editorial oversight
Single-contributor project with no official vendor support
Last commit occurred over four months ago

Setup

Claude Desktop

{
  "mcpServers": {
    "mcpguard": {
      "args": [
        "-y",
        "mcpguard-cli"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Compatibility

Client	Local	Docker	Remote	Read-only
Claude Desktop
Cursor
VS Code
Windsurf
ChatGPT

Frequently asked questions

›Where does mcpguard store my sensitive credentials?

Mcpguard stores your credentials in your operating system's native keychain, such as the macOS Keychain, Linux Secret Service, or Windows Credential Manager. It uses AES-256 encryption as a fallback for credentials not stored in the system keychain.

›Does mcpguard sync my API keys to a cloud service?

No, mcpguard is a local-first tool. It does not perform any cloud synchronization or network calls.

›Which MCP configuration files can mcpguard scan?

Mcpguard automatically scans common locations including Claude Desktop configs for macOS and Linux, Cursor's mcp.json, and various local .mcp.json files.

›How do I use my credentials after migrating to mcpguard?

Once migrated, your config files use mcpguard:// references. You can inject these credentials at runtime by running your MCP client through the 'mcpguard run' command or by utilizing the provided Node.js API.

›Can I manually add credentials without running a migration?

Yes, you can add credentials manually to the vault at any time using the 'mcpguard add <service>' command.

Badge

Maintain this server? Add the live badge to your README.