MCP Defender
Desktop app that automatically scans and blocks malicious MCP traffic in AI apps like Cursor, Claude, VS Code and Windsurf.
What is MCP Defender?
MCP Defender is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to desktop app that automatically scans and blocks malicious mcp traffic in ai apps like cursor, claude, vs code and windsurf.
Desktop app that automatically scans and blocks malicious MCP traffic in AI apps like Cursor, Claude, VS Code and Windsurf.
This server falls under the Security category on MCPgee, the world's largest MCP server directory with 33,000+ servers.
Features
- Desktop app that automatically scans and blocks malicious MC
Use Cases
Maintainer
Works with
Installation
Manual Installation
npx mcp-defenderConfiguration
Configuration Details
claude_desktop_config.json
Performance
Response Metrics
Resource Usage
How to Set Up and Use MCP Defender
MCP Defender is a desktop security application that acts as a transparent proxy between AI coding assistants (Cursor, Claude Desktop, VS Code, Windsurf) and the MCP servers they connect to, intercepting all tool call requests and responses and analyzing them against known threat signatures in real time. When suspicious or malicious traffic is detected it prompts the user to allow or block the call before it executes, preventing prompt injection and malicious tool invocations from causing damage. Security-conscious developers who run multiple MCP servers and want a safety net against compromised or malicious server packages will find it a valuable addition to their setup.
Prerequisites
- macOS (pre-built release available) or Node.js 18+ for manual installation on other platforms
- One or more AI coding assistant applications: Cursor, Claude Desktop, VS Code with MCP support, or Windsurf
- Existing MCP server configurations already set up in the protected applications
- Administrator privileges may be required to install the proxy component
Download MCP Defender
Download the latest pre-built Mac release from the GitHub releases page, or clone the repository for manual installation.
# Option A: Download pre-built Mac app from:
https://github.com/MCP-Defender/MCP-Defender/releases/latest
# Option B: Clone and install manually
git clone https://github.com/MCP-Defender/MCP-Defender.git
cd MCP-Defender
npm installLaunch MCP Defender
Open the downloaded Mac application, or start it from source. MCP Defender will run in the background as a system tray / menu bar application.
# For manual installation:
npm startConfigure MCP Defender to protect your AI apps
Follow the in-app setup to point MCP Defender at the config files for Cursor, Claude Desktop, VS Code, and/or Windsurf. The app will automatically detect and proxy MCP traffic for the configured applications.
Review and respond to security alerts
When MCP Defender flags a suspicious tool call, a dialog will appear showing the intercepted request. Review the details and click Allow or Block before the AI assistant proceeds.
Monitor MCP traffic logs
Use the MCP Defender dashboard to review the history of intercepted tool calls, including which were allowed and which were blocked, to audit AI assistant behavior over time.
MCP Defender Examples
Client configuration
MCP Defender does not require changes to your Claude Desktop config — it proxies existing MCP servers transparently. No additional mcpServers entry is needed.
{
"mcpServers": {
"your-existing-server": {
"command": "your-mcp-server-command",
"args": []
}
}
}Prompts to try
MCP Defender works transparently — use your AI assistant normally and MCP Defender will monitor in the background.
- "Read the contents of my project directory." (MCP Defender will intercept and display the filesystem tool call for review)
- "Run a shell command to list running processes." (high-risk call that MCP Defender will flag for approval)
- "Fetch this URL and return the HTML content." (network call reviewed by MCP Defender before execution)
- "Check which MCP tool calls have been blocked by MCP Defender today."
- "Show me the MCP traffic log from the last Claude session."Troubleshooting MCP Defender
MCP Defender does not intercept traffic from a specific application.
Ensure MCP Defender was configured to protect that application during setup. Re-run the in-app configuration wizard and verify the application's MCP config file path was detected correctly.
AI assistant tools stop working after installing MCP Defender.
Check the MCP Defender dashboard for blocked calls. If legitimate tool calls are being blocked by false-positive rules, use the Allow option in the dialog and consider submitting a false-positive report to the project.
npm start fails with dependency errors on manual installation.
Ensure you are running Node.js 18 or higher. Run `node --version` to verify, then run `npm install` again to reinstall all dependencies before retrying `npm start`.
Frequently Asked Questions about MCP Defender
What is MCP Defender?
MCP Defender is a Model Context Protocol (MCP) server that desktop app that automatically scans and blocks malicious mcp traffic in ai apps like cursor, claude, vs code and windsurf. It connects AI assistants to external tools and data sources through a standardized interface.
How do I install MCP Defender?
Follow the installation instructions on the MCP Defender GitHub repository. Clone the repo, install dependencies, and add the server config to your AI client.
Which AI clients work with MCP Defender?
MCP Defender works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.
Is MCP Defender free to use?
Yes, MCP Defender is open source and available under the AGPL-3.0 license. You can use it freely in both personal and commercial projects.
MCP Defender Alternatives — Similar Security Servers
Looking for alternatives to MCP Defender? Here are other popular security servers you can use with Claude, Cursor, and VS Code.
Casdoor
★ 13.6kAn open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
ghidraMCP
★ 9.0kAn Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through
HexStrike AI
★ 8.9kHexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly b
IDA Pro MCP
★ 8.7kEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.
Anthropic Cybersecurity Skills
★ 6.6k754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platform
Hooker
★ 5.1k🔥🔥 hooker is a Frida-based reverse engineering toolkit for Android. It offers a user-friendly CLI, universal scripts, auto hook generation, memory roaming to detect activities/services, one-click SOCKS5 proxy setup, Frida JustTrustMe, and BoringSSL u
Browse More Security MCP Servers
Explore all security servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.
Set Up MCP Defender in Your Editor
Choose your AI client for step-by-step setup instructions.
Quick Config Preview
Add this to your claude_desktop_config.json or .cursor/mcp.json
Ready to use MCP Defender?
Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.