MCP Guardian

Runtime security, cost governance, and health monitoring proxy for MCP infrastructure.

Proven under attack (v2.8.1)

v2.8.1 ships per-block instant attack learning on proxy policy blocks — rolling stats and attack-pattern suggestions in a sliding window while traffic is active (GUARDIAN_AI_INSTANT_LEARNING, GUARDIAN_AI_ATTACK_MIN_BLOCKS, GUARDIAN_AI_INSTANT_WINDOW_MS; debounced batch cycles remain for full AI review). Repo eval numbers below come from reports/attack-learning-eval/metrics.json (reproducible CI). sca/ adds a separate synthetic 180-minute escalation sim — use repo metrics when numbers must match CI.

Instant vs batch (long-run, verified)

pnpm eval:attack-learning:long — 5003 simulated blocked tools/call events, ~4.9h attack stream (2–5s inter-arrival, 30s batch debounce). Source: metrics.json.

Verdict: Same suggestion throughput, but instant discovers repeat (rule, tool) clusters during the stream; batch-only defers until debounce quiet periods, pushing median discovery toward session end. Deep dive: Attack learning evaluation · summary.md · docs/AI_LEARNING.md.

flowchart LR
  B[Policy block] --> I[Instant rolling stats]
  I --> Q{≥ min blocks in window?}
  Q -->|yes| S[Queue attack-pattern suggestion]
  Q -->|no| W[More blocks in stream]
  B --> D[Debounced batch cycle]
  D --> S
  S --> P[Human accept or auto-apply → policy YAML]

Hero charts (repo eval + synthetic sim)

Instant vs batch — repo eval	Stage 1 → 2 detection — synthetic 180 min sim

Instant curve rises in the first minutes; batch stays flat until ~4.9h debounce quiet — same 5 suggestions, different discovery latency (median ~41s instant vs ~4.87h batch in metrics table above).

Synthetic sim (sca/): Stage 2 detection +8.8pp avg vs Stage 1 across 12 escalating attack types (not metrics.json).

pnpm eval:attack-learning:long && pnpm eval:attack-learning:charts   # refresh fig1–fig7 + metrics.json

MCP Guardian sits between AI agents and MCP servers, enforcing active security policies, tracking real token costs, monitoring server health, and providing enterprise observability — all through a YAML-configurable engine with hot-reload.

It works as a transparent stdio proxy (real-time enforcement for Cline, Cursor, Claude Code), a standalone CLI, an interactive TUI, an MCP audit server (agents can

... View full README on GitHub