configwarden

Security scanner for AI agent configurations. Finds hardcoded secrets, dangerous MCP server setups and supply-chain risks before they reach production.

AI agents (Claude, Cursor, VS Code Copilot…) are increasingly wired to tools through the Model Context Protocol (MCP). One bad config line can hand an agent, or anyone who hijacks it through prompt injection, a shell on your machine or your whole home directory. configwarden catches these mistakes in seconds.

• Zero runtime dependencies: nothing extra to trust.
• Never prints a secret in full: reports are safe to share in CI logs.
• SARIF output: results show up natively in GitHub Code Scanning and other security dashboards.

Formerly named agentguard: renamed in October 2026 because that name was too close to other projects. Releases up to v0.2.2 use the old name.

Quick start

Requires Python 3.10+.

pip install configwarden==0.3.0
configwarden scan .

Try it on the bundled example

git clone https://github.com/Matadi-afk/configwarden
cd configwarden
pip install .
configwarden scan examples/vulnerable-mcp   # 14 findings
configwarden scan examples/safe-mcp         # the fixed version: no issues

[HIGH] CW101 MCP server runs a shell script or inline code
    mcp.json:16  Server 'helper' executes commands through 'bash -c'.
    Fix: Call the server program directly, with its arguments as separate items ...

[HIGH] CW106 MCP server container escapes isolation
    mcp.json:26  Server 'sandbox' runs a container with a mount of '/var/run/docker.sock'.
    Fix: Remove --privileged, host namespaces and mounts of '/', the home directory or the Docker socket. ...

Scanned 3 file(s), skipped 0. 14 finding(s): 0 critical, 12 high, 2 medium, 0 low.

Every value in examples/ is a fake placeholder, and the example files are named so that no AI client loads them.

Rules

Run configwarden rules to list them from the CLI.

Supported configuration files

configwarden reads every .json / .jsonc file (comments and trailing commas allowed) and looks for MCP servers wherever each AI client keeps them:

Other JSON files are only reported when they contain MCP servers. YAML (Continue) and TOML (Codex CLI) configurations are not supported yet.

Wrapped commands are unwrapped before being checked: cmd /c npx …, wsl …, env VAR=1 … (and env -S), sudo …, uv run …, pnpm exec … and bash -c "…" are all analysed for the program they really start.

Usage

configwarden scan PATH [--format text|json|sarif] [--output FILE]
                     [--fail-on low|medium|high|critical] [--exclude GLOB]...

Exit codes: 0 nothing at or above --fail-on, 1 findings, 2 usage error.

GitHub Actions

jobs:
  configwarden:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write   # needed to upload SARIF results
    steps:
      - uses: actions/checkout@v4   # pin actions to a commit SHA in production
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - run: pip install configwarden==0.3.0
      - run: configwarden scan . --format sarif --output configwarden.sarif
      - uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: configwarden.sarif

Results then appear in the repository's Security → Code scanning tab.

Development

python -m venv .venv && source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -e ".[dev]"
pre-commit install
pytest

See CHANGELOG.md for release notes and SECURITY.md to report a vulnerability.

License

Apache-2.0