mcpField
T
toxic-flow-auditor

toxic-flow-auditor

Local
github.com/GuardBeeSecurity2Updated 1d ago
Repository

About toxic-flow-auditor

toxic-flow-auditor is an MCP server for security teams auditing tool catalogs or source code for combinations of untrusted input, sensitive data, and outbound or destructive actions. It uses static heuristics and grades findings without calling live tools.

Key features

  1. 01Catalog and source scanning
  2. 02Lethal-trifecta detection
  3. 03Dangerous-pair detection
  4. 04KVKK-aware sensitivity heuristics
  5. 05A–F grading

Use cases

  1. 01Review an MCP catalog before deployment
  2. 02Scan source files for risky tool registrations
  3. 03Produce JSON or SARIF audit output

MCP support

It exposes tools to audit tools/list JSON, scan tool registrations in source text, scan files and directories, and explain the trifecta model. Analysis is static and does not invoke live tools.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "guardbee-toxic-flow-auditor": {
      "command": "npx",
      "args": [
        "-y",
        "@guardbee/mcp-toxic-flow-auditor"
      ]
    }
  }
}
Run commandnpx -y @guardbee/mcp-toxic-flow-auditor

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@guardbee/mcp-toxic-flow-auditor1.0.2

Tools

5

Saved tool list · updated 1w ago

ParameterTypeRequiredDescription
labelstringNoOptional label for the server/catalog
catalogstringYesJSON array of tools, or { tools: [...] } from tools/list

Details

From the project README

@guardbee/mcp-toxic-flow-auditor

Redthread scan

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

npm version npm downloads License: MIT

An MCP server that audits an MCP tool catalog for toxic flows — Simon Willison's lethal trifecta:

  1. Untrusted content (fetch, scrape, browse, issues, feeds)
  2. Sensitive / private data (vault, DB, secrets, KVKK-regulated PII)
  3. Exfiltration or destruction (send, webhook, export, delete, drop)

When one MCP server exposes all three, a single prompt injection can chain them. Mapped primarily to OWASP MCP10:2025.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► toxic-flow-auditor ──► tools/list JSON or MCP server source
              │
              ├─ lethal_trifecta      (untrusted + sensitive + outbound)
              ├─ single_tool_trifecta (one tool alone spans all three)
              ├─ sensitive_plus_exfil
              ├─ untrusted_plus_exfil
              └─ sensitive_plus_destruct

What it flags

  • Lethal trifecta across the catalog. Tools that fetch untrusted content, reach vault/DB/PII, and can send data out or destroy it — on the same server.
  • Single-tool trifecta. One registration whose name/description itself spans all three capabilities.
  • Dangerous pairs. Sensitive+exfil, untrusted+exfil, or sensitive+destructive even when the full trifecta is not present.
  • KVKK-aware heuristics. Turkish PII signals (tc_kimlik, müşteri, KVKK) count as sensitive data.
  • snake_case names read word by word. read_vault_secret and drop_table are classified by each word; opening a pull request counts as exfiltration.

Grades A–F. No API key. Static / catalog analysis only — does not call live tools.

The classification rules come from @guardbee/guard-core; @guardbee/mcp-security-proxy uses the same rules to block toxic flows at runtime.

Tools

ToolPurpose
audit_catalogAudit a tools/list-shaped JSON dump
scan_sourceExtract .tool(...) registrations from source text
scan_fileScan one source file
scan_directoryRecursive scan; merges tools across files
explain_trifectaExplain the model

CLI

npx @guardbee/mcp-toxic-flow-auditor audit <tools.json> [--fail-on=any] [--format=text|json|sarif]
npx @guardbee/mcp-toxic-flow-auditor scan <path>        [--fail-on=any] [--format=text|json|sarif]

Example catalog:

{
  "tools": [
    { "name": "fetch_page", "description": "Scrape a URL" },
    { "name": "read_vault_secret", "description": "Read API key from vault" },
    { "name": "send_slack_message", "description": "Post to webhook" }
  ]
}

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.