mcpField
T
toxic-flow-auditor

toxic-flow-auditor

Local
github.com/GuardBeeSecurity1Updated 1d ago
Repository

About toxic-flow-auditor

An MCP server and CLI for security teams auditing MCP tool catalogs for combinations of untrusted input, sensitive data access, and data exfiltration or destruction. It also flags dangerous pairs and grades findings from A to F without calling live tools.

Key features

  1. 01Audits tool catalogs for toxic flows
  2. 02Detects single-tool trifectas and risky pairs
  3. 03Recognizes Turkish PII signals
  4. 04Scans source files and directories
  5. 05Outputs text, JSON, or SARIF

Use cases

  1. 01Assess an MCP server's catalog before use
  2. 02Review source code for risky tool combinations
  3. 03Run catalog audits in CI/CD

MCP support

Provides tools to audit tools/list-shaped JSON, extract registrations from source, scan files and directories, and explain the trifecta model. It performs static analysis and does not invoke live tools.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "4hmetuyar-toxic-flow-auditor": {
      "command": "npx",
      "args": [
        "-y",
        "@guardbee/mcp-toxic-flow-auditor"
      ]
    }
  }
}
Run commandnpx -y @guardbee/mcp-toxic-flow-auditor

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@guardbee/mcp-toxic-flow-auditor0.1.4

Tools

5

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
labelstringNoOptional label for the server/catalog
catalogstringYesJSON array of tools, or { tools: [...] } from tools/list

Details

From the project README

@guardbee/mcp-toxic-flow-auditor

Redthread scan

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

npm version npm downloads License: MIT

An MCP server that audits an MCP tool catalog for toxic flows — Simon Willison's lethal trifecta:

  1. Untrusted content (fetch, scrape, browse, issues, feeds)
  2. Sensitive / private data (vault, DB, secrets, KVKK-regulated PII)
  3. Exfiltration or destruction (send, webhook, export, delete, drop)

When one MCP server exposes all three, a single prompt injection can chain them. Mapped primarily to OWASP MCP10:2025.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► toxic-flow-auditor ──► tools/list JSON or MCP server source
              │
              ├─ lethal_trifecta      (untrusted + sensitive + outbound)
              ├─ single_tool_trifecta (one tool alone spans all three)
              ├─ sensitive_plus_exfil
              ├─ untrusted_plus_exfil
              └─ sensitive_plus_destruct

What it flags

  • Lethal trifecta across the catalog. Tools that fetch untrusted content, reach vault/DB/PII, and can send data out or destroy it — on the same server.
  • Single-tool trifecta. One registration whose name/description itself spans all three capabilities.
  • Dangerous pairs. Sensitive+exfil, untrusted+exfil, or sensitive+destructive even when the full trifecta is not present.
  • KVKK-aware heuristics. Turkish PII signals (tc_kimlik, müşteri, KVKK) count as sensitive data.
  • snake_case names read word by word. read_vault_secret and drop_table are classified by each word; opening a pull request counts as exfiltration.

Grades A–F. No API key. Static / catalog analysis only — does not call live tools.

The classification rules come from @guardbee/guard-core; @guardbee/mcp-security-proxy uses the same rules to block toxic flows at runtime.

Tools

ToolPurpose
audit_catalogAudit a tools/list-shaped JSON dump
scan_sourceExtract .tool(...) registrations from source text
scan_fileScan one source file
scan_directoryRecursive scan; merges tools across files
explain_trifectaExplain the model

CLI

npx @guardbee/mcp-toxic-flow-auditor audit <tools.json> [--fail-on=any] [--format=text|json|sarif]
npx @guardbee/mcp-toxic-flow-auditor scan <path>        [--fail-on=any] [--format=text|json|sarif]

Example catalog:

{
  "tools": [
    { "name": "fetch_page", "description": "Scrape a URL" },
    { "name": "read_vault_secret", "description": "Read API key from vault" },
    { "name": "send_slack_message", "description": "Post to webhook" }
  ]
}

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.