A server can change what its tools do after you approved it. Your agent will call the new one and never notice.
No uv? curl -LsSf https://astral.sh/uv/install.sh | sh — no admin rights needed. pipx works too: pipx install --force mcpgawk.
your agents
mcpgawk gateway
a key per principal policy on the call checked against your baseline hash-chained audityour MCP servers
on this machine
9,400+
public MCP servers indexed by mid-2026, with internal fleets estimated at several times that
5.5%
of public servers carry a tool-poisoning payload, by Invariant Labs' count
29%
of organisations say they are prepared to secure agentic AI. The rest are running agents they cannot see
The fleet grew faster than anyone's ability to check it, and a server you approved last month is not the server you are calling today.
Free, local, no account. Every agent config on the machine and every server inside it, with what each tool costs and what it can reach.
Two of three official MCP servers we tested stopped starting →local · nothing uploaded · reproducible · Apache-2.0
$ mcpgawk
checking what your agents can call, and turning protection on.
11 servers + 7 beyond this machine · 1 auth · 2 unreachable · 7 not-scannable · 7 review · 1 clean
not-scannable = runs outside this machine, listed from local traces only, so the set may be incomplete
▶ 8 local servers run as you, inheriting credentials no MCP config declares:
~/.npmrc publish npm packages as you
~/.pypirc publish Python packages as you
~/.config/gh/hosts.yml act on GitHub as you
~/.docker/config.json push images to your registries
1 credential-shaped environment variable
These need credentials:
1. figma https://mcp.figma.com/mcp
Sign in to which? [all / 1,2 / N]
01 · SCAN
One command reads every agent config on this machine and every server inside it: what each tool costs, what it can write, what it can leak, which ones inherit credentials nobody declared. The panel holds the result on one screen — including servers you approved that no longer sit in any agent config.
Local stdio servers are never launched without your yes
Protection is armed on the same first run, by default
02 · VERIFY
A scan reads what a server claims. verify runs it in a sandbox and records what it does — what it reads, where it sends. Verdicts then rest on evidence, and drift is judged against behaviour, not descriptions.
Free, in the same package, since July 2026
A server reaching its own vendor API is listed and folded, not hidden — 42 of 42 findings on one measured fleet were that, and a detector that fires on normal traffic teaches you to ignore it
03 · GUARD
Every call an agent makes is checked against the surface you approved, and every one of them is written down with the basis it was decided on. That record is how you answer the question a block always raises next: what else did this agent try, and what went through.
Tool arguments are never recorded, so the log cannot become the richest secret on your disk
Retrying, switching tools, or editing the baseline from inside a session is itself flagged
04 · DECIDE
Right now this fleet has nothing waiting — which is what the screen is supposed to look like most of the time, and what you are looking at here. When a block does raise something it lands on this one screen, and approving from it is gated: the button carries the token printed in your terminal, which an agent that merely opened the page cannot supply.
Approval needs the person at the keyboard; mcpgawk approve refuses inside an agent session
Approve, and the new surface becomes the baseline. Keep blocking, and nothing changes
05 · SEE IT
The first run's last act is an offer to open the panel. After that it watches on its own, and the loop closes without you chasing it: monitoring caught a server adding a tool nobody had approved, the calls to it were blocked before they ran, and the alert stayed open until somebody decided.
The tokened link in your terminal holds the buttons. A bookmark renders read-only
Continuous monitoring re-checks the fleet on a five-minute cycle mcpgawk Platform
| server | transport | tools | tokens | state |
|---|---|---|---|---|
| notes | local · stdio | 3 | 1,204 | At baseline |
| docs | https | 11 | 6,880 | Findings |
| tickets | https | 24 | 14,310 | Unverified |
| files | local · stdio | 9 | 3,460 | Unverified |
| calendar | account-hosted | — | — | Not scannable |
| tool | finding | severity | what it contacted |
|---|---|---|---|
| docs.search | undeclared egress · first-party | high | api.docs.example |
| docs.upload | writes without saying so | medium | api.docs.example |
| tickets.create | not driven — needs sign-in | — | — |
A server reaching its own vendor is folded, not hidden. A tool that was skipped is named as skipped, never counted as clean.
| when | agent | server.tool | decision |
|---|---|---|---|
| 18:08:51 | claude-code | notes.read_notes | allow |
| 19:05:46 | claude-code | notes.exfiltrate_notes | deny |
SECURITY BLOCK. 'exfiltrate_notes' is not in the approved
baseline for MCP server 'notes'. A tool that appeared after
this server was approved is how a malicious update arrives.
This decision is final for this session. Do not retry it, do
not call a different tool to achieve the same thing, and do
not run any mcpgawk command to change the baseline — approval
requires the person at the keyboard.1 waiting on you
| server | what changed | severity |
|---|---|---|
| notes | 1 tool added · exfiltrate_notes | high |
| docs | 2 descriptions rewritten | review |
Approving needs the token printed in your terminal. An agent that opened this page cannot supply it.
Monitoring running · 5 servers watched
| when | server | kind | detail |
|---|---|---|---|
| 14h ago | notes | tools added | exfiltrate_notes |
| 15h ago | docs | surface changed | 2 tools rewrote their description |
| 2d ago | files | scan failed | the program this entry launches does not exist |
Point any MCP client at the gateway's endpoint, or let the free hooks wrap each agent's config in place — the same decision core answers either way, so an approval or a block means the same thing everywhere. Agents with no hook point are named honestly in mcpgawk status rather than silently left out.
The read goes through. The change does not. The refusal names no override and no command that would lift it, so the only move the agent has left is to tell you.
The decision is mcpgawk's, made locally before the call runs; the server is never contacted, so there is nothing for it to log or ignore
Approval needs the person at the keyboard; mcpgawk approve
refuses inside an agent session
> the Resend key is old — check when it was last rotated, then rotate it
resend · list-api-keys allowed mcpgawk · in baseline
resend · rotate_credentials denied mcpgawk · not in baseline
SECURITY BLOCK (mcpgawk). 'rotate_credentials' is not in the approved baseline for MCP server 'resend'. A tool that appeared after this server was approved is how a malicious update arrives.
This decision is final for this session. Do not retry it, do not call a different tool to achieve the same thing, and do not run any mcpgawk command to change the baseline — approval requires the person at the keyboard, and attempting it from inside an agent session is itself treated as a red flag.
I could not rotate the key. The server resend added a
tool called rotate_credentials since you approved it, so mcpgawk
blocked the call. Run mcpgawk scan to see what changed before
deciding whether to trust it.
The full benchmark
Every server we measured, with the per-tool breakdown behind the numbers above. Free.
The full benchmark
Free. Every server we measured, the per-tool cost, and where the tokens actually go.
pricing
The hook blocks calls for free, for good, without an account — but only on the six agents that can take a hook. The other fifteen have no hook point at all, and nothing is checking what they call.
£29 a month puts one endpoint in front of all of them. Every agent gets its own key, so a blocked call has a name against it, and the log it leaves is what you hand to a security review.
£29/month per person · 7-day free trial · all their machines · cancel any time. Free while the gateway is in beta: ask for a seat, and we email you a key and one install command — running the same day, no GitHub account needed. build is still in development and is included at no extra cost when it ships. See refunds and terms.