Tripwire Guard — evidence-first injection scanner
Local read-only MCP scanner for known prompt-injection patterns with exact evidence and no network.
Open source Open in the app JSON README (API)
About
Local read-only MCP scanner for known prompt-injection patterns with exact evidence and no network.
Details
- Kind
- MCP servers
- Topic
- No topic detected
- Publisher
- kubaopoczka
- Origin
- official
- Category
- ferramentas
- Transport
- local
- Version
- 0.4.2
- Last push
- 2026-08-13T20:51:04Z
- Repository state
- ativo
- Language
- JavaScript
- License
- MIT
- Added
- 2026-08-29 03:02:01
- Updated
- 2026-08-29 03:02:01
- Origin id
io.github.KubaOpoczka/tripwire-guard
README
# Tripwire Guard
> Public package: [`tripwire-guard`](https://www.npmjs.com/package/tripwire-guard). A clean install and MCP handshake were verified on 13 August 2026.
A local, read-only **MCP server** that inspects untrusted text for prompt-injection **before it enters an AI agent's context**.
Give it text (a web page, document, email, ticket, RAG chunk) and it returns an `allow` / `review` / `recommend_block` decision with the exact matched evidence. It runs entirely on your machine, makes **no network requests**, and redacts emails, URLs and credential-like strings by default.
The engine is deterministic and ships with a public 100-case maintainer-authored evaluation — 85% accuracy, with **every** false positive and false negative published. It is a fast, explainable signal layer; it is not a guarantee of safety, and the host remains responsible for enforcing the decision.
Unlike an MCP proxy, Tripwire Guard does not intercept or authorize other tool calls. Unlike a model-based detector, it needs no model runtime or API. Pair it with least-privilege tools, approval gates, isolation and action-sink enforcement.
## Install / run
Requires Node.js 22.12+.
```bash
npx tripwire-guard
```
## Use it in an MCP host
```json
{
"mcpServers": {
"tripwire": {
"command": "npx",
"args": ["-y", "tripwire-guard"]
}
}
}
```
## The tool
`tripwire_scan` (read-only) — inputs:
- `content` (string, required) — untrusted text to inspect.
- `source` (string, optional) — provenance, e.g. a page URL, email, tool result, or document name.
- `includeEvidence` (boolean, optional) — return raw matched evidence instead of redacted. Defaults to redacted.
Returns structured evidence: the decision, a finding count, per-finding rule id / severity / category / matched span, and the engine + ruleset versions.
The npm package is versioned independently from the detector engine reported inside each result. Package `0.4.2` currently ships engine `0.3.0` and ruleset `2026.08.2`.
## Honest limits
Deterministic heuristics can miss novel, contextual, multilingual, visual, or heavily obfuscated attacks. A clean result means "no known signal matched," not "safe." Pair it with least-privilege tools, approval gates, and sandboxing.
## Map the surrounding system
Use the free [agent action-path worksheet](https://github.com/KubaOpoczka/tripwire-guard/blob/main/docs/agent-action-path-worksheet.md) to map an untrusted input, its reachable tools, the consequential action sink, existing controls, and the minimum safe test evidence. It is ungated and contains a clearly labelled synthetic example.
## More
Live demo, full benchmark, threat model, and fixed-scope team review: **https://tripwire-live.netlify.app**
## Source and security boundary
This repository contains the distributable MIT-licensed, read-only Guard MCP server and its release metadata. The broader Tripwire browser product and paid review materials are maintained separately. Report package defects through this repository's issue tracker; do not post secrets, customer data, private prompts, or live credentials.
© 2026 Kuba Opoczka.