MCP Safety Warden — Claude Code MCP server: install
A proxy that profiles MCP tools, scans calls, and gates risky actions. Use it to audit a server or place checks before tool execution.
claude mcp add mcpsafetywarden -- uvx mcpsafetywardenWhat MCP Safety Warden does
MCP Safety Warden sits between an MCP client and another MCP server. It records tool behavior, checks arguments and returned content, applies per-tool risk decisions, and watches for drift. An audit mode can inspect a server without invoking its tools.
Its checks cover prompt-injection patterns, hostile metadata, credential-file access, SSRF, path traversal, and other argument attacks. It can pull GitHub source for secret detection, taint analysis, SAST checks, and mismatch review; source analysis covers Python and TypeScript/JavaScript. The first scan stores a SHA-256 value for later change alerts.
The CLI provides 24 subcommands, an interactive risk menu, --json, and --yes. Setup uses uvx, so that executable must be available before the command will start the server.
What it helps with
- audit an MCP server without invoking its tools
- screen tool arguments before forwarding calls
- spot prompt injection in tool output
- scan source code for secrets and unsafe data flows
- detect changes to tool schemas and inventory
Example prompts for the agent
- Audit the connected MCP server without running any of its tools.
- Inspect this tool call for prompt injection, credential-file access, SSRF, and path traversal before forwarding it.
- Check whether the MCP server has drifted since its first scan and report the change.
How to install MCP Safety Warden
Platform CLI
claude mcp add mcpsafetywarden -- uvx mcpsafetywardenuvx runs the command named after the package; if the README names another one, use uvx --from mcpsafetywarden <command>
Platform CLI
codex mcp add mcp-safety-warden -- uvx mcpsafetywardenuvx runs the command named after the package; if the README names another one, use uvx --from mcpsafetywarden <command>
Config file
{
"mcpServers": {
"mcp-safety-warden": {
"command": "uvx",
"args": [
"mcpsafetywarden"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from mcpsafetywarden <command>
Config file
{
"servers": {
"mcp-safety-warden": {
"type": "stdio",
"command": "uvx",
"args": [
"mcpsafetywarden"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from mcpsafetywarden <command>
Platform CLI
gemini mcp add mcp-safety-warden uvx mcpsafetywardenuvx runs the command named after the package; if the README names another one, use uvx --from mcpsafetywarden <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about MCP Safety Warden
How do I install MCP Safety Warden in Claude Code?
Run claude mcp add mcpsafetywarden -- uvx mcpsafetywarden.
What does MCP Safety Warden do?
It proxies another MCP server, profiles its tools, scans calls and outputs, applies risk gates, and supports server audits.
What is required to run MCP Safety Warden?
The setup command uses uvx, so that executable needs to be available in the environment.
