# Tripwire Guard

> Public package: [`tripwire-guard`](https://www.npmjs.com/package/tripwire-guard). A clean install and MCP handshake were verified on 13 August 2026.

A local, read-only **MCP server** that inspects untrusted text for prompt-injection **before it enters an AI agent's context**.

Give it text (a web page, document, email, ticket, RAG chunk) and it returns an `allow` / `review` / `recommend_block` decision with the exact matched evidence. It runs entirely on your machine, makes **no network requests**, and redacts emails, URLs and credential-like strings by default.

The engine is deterministic and ships with a public 100-case maintainer-authored evaluation — 85% accuracy, with **every** false positive and false negative published. It is a fast, explainable signal layer; it is not a guarantee of safety, and the host remains responsible for enforcing the decision.

Unlike an MCP proxy, Tripwire Guard does not intercept or authorize other tool calls. Unlike a model-based detector, it needs no model runtime or API. Pair it with least-privilege tools, approval gates, isolation and action-sink enforcement.

## Install / run

Requires Node.js 22.12+.

```bash
npx tripwire-guard
```

## Use it in an MCP host

```json
{
  "mcpServers": {
    "tripwire": {
      "command": "npx",
      "args": ["-y", "tripwire-guard"]
    }
  }
}
```

## The tool

`tripwire_scan` (read-only) — inputs:

- `content` (string, required) — untrusted text to inspect.
- `source` (string, optional) — provenance, e.g. a page URL, email, tool result, or document name.
- `includeEvidence` (boolean, optional) — return raw matched evidence instead of redacted. Defaults to redacted.

Returns structured evidence: the decision, a finding count, per-finding rule id / severity / category / matched span, and the engine + ruleset versions.

The npm package is versioned independently from the detector engine reported inside each result. Package `0.4.2` currently ships engine `0.3.0` and ruleset `2026.08.2`.

## Honest limits

Deterministic heuristics can miss novel, contextual, multilingual, visual, or heavily obfuscated attacks. A clean result means "no known signal matched," not "safe." Pair it with least-privilege tools, approval gates, and sandboxing.

## Map the surrounding system

Use the free [agent action-path worksheet](https://github.com/KubaOpoczka/tripwire-guard/blob/main/docs/agent-action-path-worksheet.md) to map an untrusted input, its reachable tools, the consequential action sink, existing controls, and the minimum safe test evidence. It is ungated and contains a clearly labelled synthetic example.

## More

Live demo, full benchmark, threat model, and fixed-scope team review: **https://tripwire-live.netlify.app**

## Source and security boundary

This repository contains the distributable MIT-licensed, read-only Guard MCP server and its release metadata. The broader Tripwire browser product and paid review materials are maintained separately. Report package defects through this repository's issue tracker; do not post secrets, customer data, private prompts, or live credentials.

© 2026 Kuba Opoczka.