injection-pii-guardrail-mcp

# Agent Guardrail MCP An MCP (Model Context Protocol) server that gives any agent client — Claude Desktop, Claude Code, or a custom pipeline — a callable security layer: prompt injection detection, PII/secrets redaction, and a queryable audit trail. Built to demonstrate the agent-governance primitives enterprises are increasingly requiring before approving agents for production. ## What it does Three concerns, exposed as four MCP tools: | Concern | Tool | What it returns | |---|---|---| | Is incoming text trying to manipulate the agent? | `scan_input(text, source)` | Risk score (0–100), risk level, matched reasons, recommendation | | Could outgoing text leak PII or secrets? | `scan_output(text)` | Findings list, a redacted-safe version of the text, recommendation | | What has the guardrail seen? | `get_audit_trail(limit, risk_level)` | Recent scan records, filterable by risk level | | Give me an overview | `get_guardrail_stats()` | Aggregate counts by risk level, scan type, recommendation | Detection is regex-based — no ML model, no external API call required for the core path. It's fast, has zero runtime dependencies beyond the standard library for the detectors themselves, and every decision is explainable: the system tells you *which pattern matched and why*, not just a score. ## Project structure ``` agent-guardrail-mcp/ ├── pyproject.toml # packaging metadata, console script entry point ├── requirements.txt # for local dev without installing the package │ ├── guardrail/ │ ├── __init__.py │ ├── server.py # MCP server — exposes the four tools, console entry point │ ├── injection_detector.py # 23 weighted regex patterns, 5 attack categories │ ├── pii_detector.py # PII + credential detection and redaction │ └── audit.py # append-only SQLite audit log │ ├── eval/ │ ├── eval_set.json # 35 labeled samples (22 malicious, 13 benign) │ └── run_eval.py # computes pre…