M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
M

MCP Defender

Community
Gateway / proxy
Automatically protects MCP traffic in AI apps

This gateway aggregates or proxies other MCP servers; it only becomes useful once you connect real servers behind it.

How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #380 of 438
Stars
★ 255 Popular
Runtime
Node.js · Prebuilt binary
Credentials
No credential needed
License
AGPL-3.0
Last commit
36FMRS · D

MCP Defender is a desktop app, acquired by Docker Inc., that proxies MCP tool call requests and responses from AI apps (Cursor, Claude, Visual Studio Code, Windsurf), checks them against signatures, and prompts the user to allow or block when harmful content is detected. It is distributed primarily as a Mac download and can also be run from source. The source material provides no server manifest, tool list, transport, or client config example, so those fields are left empty. It suits developers on these AI clients who want added protection for MCP traffic; it is not for non-Mac users, users expecting config-file installation of an MCP server, or scenarios needing a server-side centralized security gateway.

Strongest · Security and permissions 9/20 Weakest · Reliability 5/20

Reliability
5/20
Security and permissions
9/20
Maintenance
7/20
Documentation
7/20
Setup experience
8/20
Why each score
Reliability 5/20
The only static evidence is a README: it describes a desktop app started via npm install / npm start that proxies MCP tool-call requests and responses from AI apps and matches them against signatures. No committed tests, CI workflows, manifest, or error-handling notes are present, so the MCP init and tool-list handshake cannot be verified, nor can declared tool behavior be checked against reality. Under the static calibration rule (no reliability above 12 without verifiable execution evidence), and further lowered because key paths are entirely unverified and dependency/error controllability is undisclosed, the score is 5.
Security and permissions 9/20
Per the README, the design intercepts and inspects MCP traffic and prompts the user to allow or block when something harmful is detected, which reads as a visible, user-confirmed mechanism. No credential theft, covert exfiltration, irreversible delete/pay/deploy/remote-command defaults without confirmation, fabricated identity, or install examples with real secrets were observed, so the 0-4 red-line band is not triggered. However, all security claims come from the README itself: no reviewable implementation, permission scope, data-retention policy, or external-network disclosure exists, and failure-mode behavior is unknown, so points are deducted.
Maintenance 7/20
Licensed AGPL-3.0, not archived, 257 stars and 5 open issues, and the README banner states acquisition by Docker Inc. with a link to Docker's blog, indicating a clear owner and some activity—positive signals for sustained maintenance. But no commit history, release cadence, dependency-update practice, issue-response latency, or security-response channel is visible in the static evidence, so governance and versioning gaps remain and the score is moderate rather than full.
Documentation 7/20
The README covers purpose, mechanism (proxy plus signature matching), supported clients (Cursor, Claude, VS Code, Windsurf), and both binary-download and from-source install paths—usable. It lacks tool parameters, signature details, known limitations, troubleshooting, and permission/data-flow disclosure; the quick start is two commands with no stated runtime requirements (e.g., Node version), leaving hidden assumptions, hence deductions.
Setup experience 8/20
On macOS a release download suffices; from source it is npm install followed by npm start—few, clear steps. Yet Node version requirements are absent, no client configuration examples (e.g., Cursor/Claude MCP config snippets) are given, Windows/Linux support is unstated, and there is no way to verify the proxy is active. This is fairly easy but incomplete, and with no committed tests or CI as verifiable execution evidence the static cap of 15 applies, so the score is 8.

Static review · not runListed 2026-09-10

Read the FMRS scoring method →

Fit and risk

What it can accessUses the network

Best for

  • Developers using Cursor, Claude, Visual Studio Code or Windsurf who want to protect their MCP traffic
  • Users who want signature-based alerting and blocking at the MCP tool call level

Not for

  • Users who are not on Mac or do not use the supported AI clients listed above
  • Users expecting to install an MCP server via a client config file rather than a desktop app
  • Scenarios requiring a server-side or cloud-centralized MCP security gateway (not described in the source)

Required permissions

  • Proxying MCP tool call requests and responses between AI apps and MCP servers in order to intercept them
  • Inspecting intercepted request and response content locally to match signatures

Risks and side effects

  • The source does not describe the signature set or detection coverage, so misses are possible
  • All MCP traffic is proxied through the desktop app, so proxy issues could affect normal tool calls in AI apps
  • Allow-or-block decisions on suspected harmful content depend on the user, and false positives may block legitimate calls
  • The source does not describe how data is processed or stored, so privacy impact should be assessed independently

Setup

Before you start

Runtime：Node.js · Prebuilt binary

  1. Download MCP Defender for Mac from the GitHub Releases page.
  2. Alternatively, clone the git repo and run:

npm install
npm start

Check that it works

Download the Mac build and launch MCP Defender, or clone the repo and run npm install && npm start; once running it automatically proxies MCP traffic from Cursor, Claude, VS Code and Windsurf, so triggering an MCP tool call in a protected app should show Defender intercepting and signature-scanning it.

Troubleshooting

  1. Make sure the latest version is downloaded and installed from GitHub Releases
  2. If running from source fails, run npm install before npm start
  3. Confirm the AI app in use is one of the supported ones: Cursor, Claude, Visual Studio Code or Windsurf
  4. If a tool call is blocked, review the MCP Defender alert and choose to allow or block
  5. Confirm the app is being proxied by MCP Defender so its MCP tool call requests and responses are intercepted

Use cases

Automatically proxy and inspect MCP tool calls while using Cursor, Claude, VS Code or Windsurf
Get alerted and choose to allow or block when a harmful MCP tool call request or response is detected
Add a layer of security to MCP traffic while developing AI apps locally

Overview

MCP Defender is a desktop app that protects AI apps like Cursor from a variety of attacks. All MCP tool call requests and responses from AI apps are automatically proxied through MCP Defender; the intercepted data is then checked against a set of signatures. If anything harmful is detected, MCP Defender alerts you and asks whether to allow or block the tool call. It automatically protects Cursor, Claude, Visual Studio Code and Windsurf. MCP Defender has been acquired by Docker Inc.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision 7fa7e7571a22 Data synced 2026-10-19 Read the FMRS scoring method