Dev Machine Guard MCP

Overview

Dev Machine Guard is an MCP server from Step Security that scans your development machine for AI agents, MCP servers, and IDE extensions — and flags the risky ones. It's the first security tool that treats your agent ecosystem itself as the attack surface.

The premise: you install dozens of MCP servers and agent plugins. Some leak data, some have supply-chain vulnerabilities, some contain backdoors. Dev Machine Guard provides a single-pane audit: here's every AI-related package on this machine, and here's what each one can do.

Featured on Show HN with 9 points and backed by Step Security's threat research team.

Features

• MCP server inventory: discover every installed MCP server and its declared tools
• IDE extension audit: scan VS Code, Cursor, Zed, and JetBrains extensions
• Agent config inspection: parse .claude/, .cursor/, .vscode/mcp.json, etc.
• Permission analysis: report what each tool can access (filesystem, network, shell)
• CVE checking: cross-reference packages with known vulnerabilities
• Signature verification: check for tampered or unsigned packages
• Reports as JSON/Markdown: machine- and human-readable output

Installation

# Install the MCP server
npm install -g @step-security/dev-machine-guard

# Or run directly
npx -y @step-security/dev-machine-guard

Configuration

{
  "mcpServers": {
    "dev-machine-guard": {
      "command": "npx",
      "args": ["-y", "@step-security/dev-machine-guard"],
      "env": {
        "DMSG_SCAN_PATHS": "~,~/projects,~/work",
        "DMSG_REPORT_FORMAT": "markdown"
      }
    }
  }
}

Available Tools

Tool	Description
scan_system	Full audit of the machine for AI-related packages
scan_directory	Scan a specific directory for agent configs
list_mcp_servers	Enumerate all discovered MCP servers
list_extensions	Enumerate all AI-related IDE extensions
check_package	Get security details for a specific package
check_cves	Cross-reference a package list with CVE database
generate_report	Produce a full audit report

Example Usage

Full machine scan

Ask Claude: "Scan my machine for risky MCP servers."

{
  "tool": "scan_system",
  "args": {
    "paths": ["~", "~/projects"],
    "include_cves": true,
    "include_permissions": true
  }
}

Sample output:

## Audit Report — 2026-08-28

### Discovered MCP Servers (14)
- github-mcp: ✅ Safe. Scoped to `repo`, `read:org`.
- notion-mcp: ⚠️ Broad permissions. `full_access: true`.
- custom-search-mcp: ❌ Unknown package. No signature. Review required.

### CVE Findings
- server-foo 1.2.3: CVE-2026-1234 (medium) — command injection in `run_query`
- server-bar 0.9.1: ✅ No known CVEs

### IDE Extensions
- Claude Code v2.1.3: ✅ Signed
- Custom LSP v0.4.0: ⚠️ Not signed

Scan in CI

# .github/workflows/security.yml
- name: AI Agent Security Audit
  uses: step-security/dev-machine-guard-action@v1
  with:
    paths: "."
    fail_on: "high"

Pros

• ✅ Fills a real gap: no other tool audits your agent ecosystem
• ✅ MCP-native: integrates with any MCP client
• ✅ CI-friendly: can run in pipelines with fail_on thresholds
• ✅ Backed by a security vendor: Step Security is a real threat research team
• ✅ JSON and Markdown reports: use anywhere

Cons

• ❌ Point-in-time scan: no continuous monitoring
• ❌ No remediation: identifies risks but doesn't fix them
• ❌ Local machine only: doesn't audit remote or cloud deployments
• ❌ Small community: ~60 GitHub stars
• ❌ May flag false positives: unsigned but legitimate packages get flagged

When to Use

Use Dev Machine Guard MCP when:

• You install lots of MCP servers and lose track of what's on your machine
• You want a security audit of your AI toolchain before production
• You're building CI/CD and want to catch supply-chain issues early
• You're onboarding developers and want to verify their AI tool configs

Prefer alternatives when:

• You need continuous monitoring — no MCP server does this
• You need to audit cloud deployments — this is local-only
• You want automated remediation — Dev Machine Guard only reports

Resources

• GitHub Repository
• Show HN discussion
• Step Security