@guardbee/mcp-context-oversharing-auditor

@guardbee/mcp-context-oversharing-auditor

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

An MCP server that audits agent/MCP source for OWASP MCP10:2025 — context oversharing.

toxic-flow-auditor grades whether a tool catalog can chain the lethal trifecta. This package asks a different MCP10 question: does a handler return more session, memory, or system context than the current user/tenant should see?

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

What it flags

Pattern	Severity	Meaning
tool_dumps_full_conversation	critical	Tool returns full messages / conversation history
unscoped_memory_recall_tool	high	dump_memory / get_all_memories-style tools
shared_global_session_store	high	Global session Map/dict without per-user keys
system_prompt_exposed_via_tool	high	Tool returns systemPrompt / developer instructions
cross_session_tool_result_reuse	medium	Prior tool results mixed into another session's context
vector_query_without_filter	high	Vector/RAG search with no tenant/user metadata filter

Quick start

{
  "mcpServers": {
    "guardbee-context-oversharing-auditor": {
      "command": "npx",
      "args": ["-y", "@guardbee/mcp-context-oversharing-auditor"]
    }
  }
}

npx @guardbee/mcp-context-oversharing-auditor scan ./src --format=sarif

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.