How do I install Agent Graph Auditor?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Agent Graph Auditor need an API key?

No required environment variable is listed on this record.

What transport does Agent Graph Auditor use?

Agent Graph Auditor runs locally over stdio.

When was Agent Graph Auditor last checked?

Last checked 2026-11-08. Finds transitive excessive agency across LangGraph/CrewAI/AutoGen orchestration graphs

Agent Graph Auditor MCP server

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y @guardbee/[email protected]

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add io.github.4hmetuyar-agent-graph-auditor -- npx -y @guardbee/mcp-agent-graph-auditor@0.1.2

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.4hmetuyar-agent-graph-auditor": {4      "command": "npx",5      "args": [6        "-y",7        "@guardbee/[email protected]"8      ]9    }10  }11}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.1.2
Last checked

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

GuardBee MCP

Security for AI agents and MCP. GuardBee puts a gateway between your agents and their tools and models that masks personal data and secrets, blocks prompt injection and toxic data flows, asks before risky calls and keeps a tamper-evident audit log, plus scanners that check your code and configs against the OWASP MCP Top 10. Open source (MIT), runs on your machine, no account needed.

# Put your existing MCP servers behind the gateway (backs up your client config first)
npx -y @guardbee/mcp-security-proxy@^1 init --client claude-desktop   # or cursor, claude-code

# Check a codebase against the OWASP MCP Top 10
npx -y @guardbee/mcp-owasp-scan scan . --fail-on=high

An agent calls a CRM through GuardBee: personal data is masked, a prompt injection is blocked, and sending data out after reading untrusted and sensitive content is refused

Run it yourself: examples/demo (npm install && npm start).

Which package should I use?

You want to…	Install	How
Protect agents at runtime: mask personal data, block injection and toxic flows, approve risky calls, keep an audit log	`@guardbee/mcp-security-proxy`	Put it in front of your MCP servers (`guardbee-proxy init` imports your client config)
Check a codebase against the OWASP MCP Top 10 in one pass, in CI	`@guardbee/mcp-owasp-scan`	`npx @guardbee/mcp-owasp-scan scan . --format=sarif --fail-on=high`
Give an agent many GuardBee checks from one MCP server	`@guardbee/security-suite`	`guardbee serve` (recommended set), `--tools=code,network` or `all`
Find leaked keys in files, git history or agent transcripts	`@guardbee/mcp-secret-scanner`	`npx @guardbee/mcp-secret-scanner scan . --history`
Audit the MCP servers configured on developer machines	`@guardbee/mcp-config-auditor`	`npx @guardbee/mcp-config-auditor discover`
Let an agent query a database without seeing raw personal data	`@guardbee/mcp-db-gateway`	Point it at your database with a policy
Use the detectors in your own code	`@guardbee/guard-core`	`import { maskPiiInText } from "@guardbee/guard-core"`

Every other package is a single check (one OWASP risk, one protocol, one file type); each is in security-suite too. npx @guardbee/security-suite list shows them with what they check.

Benchmarks

Detection is measured, not claimed: packages/pii-bench is a reproducible benchmark for Turkish and international personal data, with bootstrap 95% intervals and the datasets in the repo.

Benchmark	Result
Identifiers (TC Kimlik, IBAN, card, phone, e-mail, …), 400 documents + 160 clean	F1 97.1, recall 100%, false alarms on clean documents 8.1%, 0.04 ms per document
Person names with the optional NER model, same set	F1 99.5
Hand-written hard cases for names (tr-names-challenge)	F1 97.1, 0 false alarms
KVKK Art. 6 special categories with NER (tr-special-challenge)	F1 97.5, 0 false alarms
Bypass suite: 5 identifiers × 16 disguises (base64, hex, URL/HTML/`\u` escapes, other scripts' digits, separators)	80 / 80 masked, 0 of 16 look-alike strings changed

The identifier detectors were tuned after reading this set's misses, so the challenge sets are the fairer measure; the pii-bench README lists the limits. Any other detector can be run on the same data through its System interface.

Examples

Ready-to-copy proxy policies (minimal, KVKK, coding agent, LLM gateway), client configs for Claude Desktop, Claude Code, Cursor and VS Code, and CI templates for GitHub Actions and GitLab: examples/.

Packages

Package	npm	Description
`packages/ai-code-scanner`	`@guardbee/mcp-ai-code-scanner`	Scans a codebase for insecure LLM/AI integration patterns (client-exposed keys, unsafe output handling, excessive agency, PII→prompt, prompt injection)
`packages/compliance-checker`	`@guardbee/mcp-compliance-checker`	KVKK/GDPR/CCPA compliance checks
`packages/dependency-auditor`	`@guardbee/mcp-dependency-auditor`	CVE scanning for npm/pip/cargo dependencies (OSV)
`packages/dns-intelligence`	`@guardbee/mcp-dns-intelligence`	DNS record enumeration, misconfiguration and dangling-subdomain detection
`packages/db-gateway`	`@guardbee/mcp-db-gateway`	KVKK/GDPR-compliant gateway between an LLM and a database (PII masking, RBAC, rate limiting, queryable audit log; Prisma/Postgres/MySQL/SQLite/MongoDB adapters; optional insert/update/delete support)
`packages/mcp-server-auditor`	`@guardbee/mcp-server-auditor`	Scans other MCP servers' tool definitions for insecure patterns (excessive agency, shell/eval/SQL/SSRF sinks, loose schemas, hardcoded secrets, wildcard CORS)
`packages/prompt-injection-scanner`	`@guardbee/mcp-prompt-injection-scanner`	Scans RAG content/scraped pages for indirect prompt injection (instruction override, spoofed role/chat-template tokens, hidden text, "Dear AI" direct address, data-exfiltration instructions)

Security

Found a vulnerability? Report it privately: see SECURITY.md. Contributions are welcome: CONTRIBUTING.md.

Telemetry

Packages can send usage telemetry to GuardBee via @guardbee/mcp-telemetry: which tool is called, how often, and how long it takes. It is off by default (opt-in); nothing is sent unless you set GUARDBEE_TELEMETRY=1. When it is on, a one-time notice is printed to stderr on first use.

To enable: GUARDBEE_TELEMETRY=1 (or true/on/yes); unset it to turn telemetry off again
What's sent: tool name, short (≤40 character) parameter values (e.g. table: "users", limit: 50), success/failure, duration
What's NEVER sent: values under keys like content/text/data/filter/password/email/apiKey/token, and any string longer than 40 characters — all replaced with "[redacted: ...]" by redactParams() in packages/telemetry/src/redact.ts. So the full content of scanned files/code, or the real row data from an insert_row/update_row call, is never sent.

Details: packages/telemetry/README.md.

Development

pnpm install
pnpm build     # turbo run build — all packages, in dependency order
pnpm test      # turbo run test

To work on a single package:

pnpm --filter @guardbee/mcp-ssl-inspector dev

Versioning and publishing

Packages are versioned independently (Changesets). If you changed something in a PR:

pnpm changeset

After merging to main, CI automatically opens a version PR; merging that PR publishes the changed packages to npm (see .github/workflows/release.yml).

Stability

Packages at 1.0 or later follow semantic versioning: a breaking change to the CLI, the MCP tool names and parameters, the config format or the exported API comes only with a new major version, and is listed in the package's CHANGELOG.md. New rules and detectors arrive in minor versions; they can report findings an earlier version did not. Packages still at 0.x may change between minor versions.

Package	Stable since
`@guardbee/mcp-security-proxy`	1.0
`@guardbee/guard-core`	1.0
`@guardbee/mcp-secret-scanner`	1.0
`@guardbee/mcp-prompt-injection-scanner`	1.0
`@guardbee/mcp-prompt-leak-scanner`	1.0
`@guardbee/mcp-toxic-flow-auditor`	1.0

Structure

pnpm workspaces — packages/*, real workspace:* dependencies (e.g. security-suite depends on the other packages directly from the workspace, not a registry version)
Turborepo — build/test/type-check pipeline, dependency-graph-aware ordering and caching
Shared config — tsconfig.base.json and vitest.shared.ts at the root; each package layers its own settings on top

Project history

The monorepo's earlier write-ups are in CHANGELOG.md; each package's release notes are in its own CHANGELOG.md and on GitHub Releases.

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Agent Graph Auditor?

Does Agent Graph Auditor need an API key?

What transport does Agent Graph Auditor use?

When was Agent Graph Auditor last checked?

Documentation

GuardBee MCP

Which package should I use?

Benchmarks

Examples

Packages

Security

Telemetry

Development

Versioning and publishing

Stability

Structure

Project history