mcpgawk sits between your agents and their MCP servers. If a tool changes after you approved it, mcpgawk holds that call until you say so. Calls to tools that haven't changed go straight through. Free, on your machine, nothing uploaded.
Open source · works with Claude Code, Cursor, Codex, Windsurf and Gemini CLI · no uv? pipx install --force mcpgawk
your agents
mcpgawk gateway
a key per principal policy on the call checked against your baseline hash-chained audityour MCP servers
on this machine
mcpgawk in 50 seconds
Install it where you already work
PyPI:
pipx install --force mcpgawk
VS Code Marketplace: search “mcpgawk”
Open VSX: the same extension, for editors that install from Open VSX
The full benchmark
Every server we measured, with the per-tool breakdown behind the numbers above. Free.
The full benchmark
Free. Every server we measured, the per-tool cost, and where the tokens actually go.
9,400+
public MCP servers indexed by mid-2026, with internal fleets estimated at several times that
5.5%
of public servers carry a tool-poisoning payload, by Invariant Labs' count
29%
of organisations say they are prepared to secure agentic AI. The rest are running agents they cannot see
The fleet grew faster than anyone's ability to check it, and a server you approved last month is not the server you are calling today.
Free, local, no account. Every agent config on this machine and every server in it — what each costs and what it can reach.
Two of three official MCP servers stopped starting →local · nothing uploaded · reproducible · Apache-2.0
$ mcpgawk
checking what your agents can call, and turning protection on.
11 servers + 7 beyond this machine · 1 auth · 2 unreachable · 7 not-scannable · 7 review · 1 clean
not-scannable = runs outside this machine, listed from local traces only, so the set may be incomplete
▶ 8 local servers run as you, inheriting credentials no MCP config declares:
~/.npmrc publish npm packages as you
~/.pypirc publish Python packages as you
~/.config/gh/hosts.yml act on GitHub as you
~/.docker/config.json push images to your registries
1 credential-shaped environment variable
These need credentials:
1. figma https://mcp.figma.com/mcp
Sign in to which? [all / 1,2 / N]
01 · SCAN
One command reads every agent config on this machine and every server inside it: what each tool costs, what it can write, what it can leak, which ones inherit credentials nobody declared. The panel holds the result on one screen — including servers you approved that no longer sit in any agent config.
Local stdio servers are never launched without your yes
Protection is armed on the same first run, by default
02 · VERIFY
A scan reads what a server claims. verify runs it in a sandbox and records what it does — what it reads, where it sends. Verdicts then rest on evidence, and drift is judged against behaviour, not descriptions.
Free, in the same package, since July 2026
A server reaching its own vendor API is listed and folded, not hidden — 42 of 42 findings on one measured fleet were that, and a detector that fires on normal traffic teaches you to ignore it
03 · GUARD
Every call an agent makes is checked against the surface you approved, and every one of them is written down with the basis it was decided on. That record is how you answer the question a refusal always raises next: what else did this agent try, and what went through.
Tool arguments are never recorded, so the log cannot become the richest secret on your disk
Retrying, switching tools, or editing the baseline from inside a session is itself flagged
04 · DECIDE
Right now this fleet has nothing waiting — which is what the screen is supposed to look like most of the time, and what you are looking at here. When something is refused it lands on this one screen, and approving from it is gated: the button carries the token printed in your terminal, which an agent that merely opened the page cannot supply.
Approval needs the person at the keyboard; mcpgawk approve refuses inside an agent session
Approve, and the new surface becomes the baseline. Keep refusing it, and nothing changes
05 · SEE IT
The first run's last act is an offer to open the panel. After that it keeps checking on its own schedule for as long as you leave it running, and the loop closes without you chasing it: monitoring caught a server adding a tool nobody had approved, the calls to it were refused before they ran, and the alert stayed open until somebody decided.
The tokened link in your terminal holds the buttons. A bookmark renders read-only
mcpgawk changes shows exactly what moved on a server between snapshots — the history a fresh scan can never show you
Continuous monitoring re-checks the fleet on a five-minute cycle mcpgawk Platform
A licence turns on enforce and monitor with one command — mcpgawk login your-key, on the same install, nothing else to set up mcpgawk Platform
| server | transport | tools | tokens | state |
|---|---|---|---|---|
| notes | local · stdio | 3 | 1,204 | Verified |
| docs | https | 11 | 6,880 | Findings |
| tickets | https | 24 | 14,310 | Unverified |
| files | local · stdio | 9 | 3,460 | Unverified |
| calendar | account-hosted | — | — | Not scannable |
| tool | finding | severity | what it contacted |
|---|---|---|---|
| docs.search | undeclared egress · first-party | high | api.docs.example |
| docs.upload | writes without saying so | medium | api.docs.example |
| tickets.create | not driven — needs sign-in | — | — |
A server reaching its own vendor is folded, not hidden. A tool that was skipped is named as skipped, never counted as clean.
| when | agent | server.tool | decision |
|---|---|---|---|
| 18:08:51 | claude-code | notes.read_notes | allow |
| 19:05:46 | claude-code | notes.exfiltrate_notes | deny |
SECURITY BLOCK. 'exfiltrate_notes' is not in the approved
baseline for MCP server 'notes'. A tool that appeared after
this server was approved is how a malicious update arrives.
This decision is final for this session. Do not retry it, do
not call a different tool to achieve the same thing, and do
not run any mcpgawk command to change the baseline — approval
requires the person at the keyboard.1 waiting on you
| server | what changed | severity |
|---|---|---|
| notes | 1 tool added · exfiltrate_notes | high |
| docs | 2 descriptions rewritten | review |
Approving needs the token printed in your terminal. An agent that opened this page cannot supply it.
Monitoring running · 5 servers watched
| when | server | kind | detail |
|---|---|---|---|
| 14h ago | notes | tools added | exfiltrate_notes |
| 15h ago | docs | surface changed | 2 tools rewrote their description |
| 2d ago | files | scan failed | the program this entry launches does not exist |
via gateway
via gateway
via gateway
via gateway
via gateway
via gateway
via gateway
via gateway
via gateway
Point any client at the gateway, or let the free hooks wrap its config in place — the same core answers either way. Agents with no hook point are named honestly in mcpgawk status, never silently dropped.
The read goes through. The change does not. The refusal names no override and no command that would lift it, so the only move the agent has left is to tell you.
The decision is mcpgawk's, made locally before the call runs; the server is never contacted, so there is nothing for it to log or ignore
Approval needs the person at the keyboard; mcpgawk approve
refuses inside an agent session
> the Resend key is old — check when it was last rotated, then rotate it
resend · list-api-keys allowed mcpgawk · in baseline
resend · rotate_credentials denied mcpgawk · not in baseline
SECURITY BLOCK (mcpgawk). 'rotate_credentials' is not in the approved baseline for MCP server 'resend'. A tool that appeared after this server was approved is how a malicious update arrives.
This decision is final for this session. Do not retry it, do not call a different tool to achieve the same thing, and do not run any mcpgawk command to change the baseline — approval requires the person at the keyboard, and attempting it from inside an agent session is itself treated as a red flag.
I could not rotate the key. The server resend added a
tool called rotate_credentials since you approved it, so mcpgawk
refused the call. Run mcpgawk scan to see what changed before
deciding whether to trust it.
Rolling this out across a team? 20 minutes with the founder: your servers, your agents, what the gateway would log. Email to book a call →
pricing
The hook stops a changed call for free, for good, without an account — but only on the six agents that can take a hook. The other fifteen have no hook point at all, and nothing is checking what they call.
The gateway puts one endpoint in front of all of them. Every agent gets its own key, so a refused call has a name against it, and the log it leaves is what you hand to a security review.
Per person · 7-day free trial · up to 3 machines · cancel any time. Start the free 7-day trial with no card, or subscribe; either way we email you a key and one install command — running the same day, no GitHub account needed. build is still in development and is included at no extra cost when it ships. See refunds and terms.
Rolling this out across a team? 20 minutes with the founder: your servers, your agents, what the gateway would log. Email to book a call →