shrike-mcp

MCP (Model Context Protocol) server for Shrike Security — protect AI agents from prompt injection, jailbreaks, SQL injection, data exfiltration, and malicious file operations.

Installation

npm install -g shrike-mcp

Or use with npx:

npx shrike-mcp

Quick Start

With Claude Desktop

Add to your Claude Desktop configuration (~/.claude/claude_desktop_config.json):

{
  "mcpServers": {
    "shrike-security": {
      "command": "npx",
      "args": ["shrike-mcp"],
      "env": {
        "SHRIKE_API_KEY": "your-api-key-here"
      }
    }
  }
}

Without an API key, scans run on the free tier (regex-only layers L1–L4). With an API key, you get the full 9-layer scan pipeline including LLM semantic analysis.

Environment Variables

Available Tools

scan_prompt

Scans user prompts for prompt injection, jailbreak attempts, and malicious content. Supports PII redaction with token-based rehydration.

Parameters:

Example:

const result = await mcp.callTool('scan_prompt', {
  content: userInput,
  context: conversationHistory,
  redact_pii: true,
});

if (result.blocked) {
  console.log('Threat detected:', result.threat_type);
} else if (result.pii_redaction) {
  // Use redacted content for LLM processing
  const safePrompt = result.pii_redaction.redacted_content;
}

scan_response

Scans LLM-generated responses before showing them to users. Detects system prompt leaks, unexpected PII, toxic language, and topic drift. Rehydrates PII tokens when provided.

Parameters:

Example:

const result = await mcp.callTool('scan_response', {
  response: llmOutput,
  original_prompt: userInput,
  pii_tokens: scanPromptResult.pii_redaction?.tokens,
});

if (result.blocked) {
  console.log('Response blocked:', result.threat_type);
} else if (result.rehydrated_response) {
  // PII tokens replaced with original values
  showToUser(result.rehydrated_response);
}

scan_sql_query

Scans SQL queries for injection attacks and dangerous operations before execution.

Parameters:

Example:

const result = await mcp.callTool('scan_sql_query', {
  query: sqlQuery,
  database: 'postgresql',
});

if (result.blocked) {
  throw new Error(`SQL injection detected: ${result.guidance}`);
}

scan_file_write

Validates file paths and content before write operations. Checks for path traversal, secrets in content, and sensitive file access.

Parameters:

Example:

const result = await mcp.callTool('scan_file_write', {
  path: filePath,
  content: fileContent,
  mode: 'create',
});

if (result.blocked) {
  throw new Error(`File write blocked: ${result.guidance}`);
}

scan_web_search

Scans web search queries for PII exposure, data exfiltration patterns, and blocked domains.

Parameters:

Example:

const result = await mcp.callTool('scan_web_search', {
  query: searchQuery,
  targetDomains: ['example.com'],
});

if (result.blocked) {
  console.log('Search blocked:', result.guidance);
}

report_bypass

Reports content that bypassed security checks to improve detection via ThreatSense pattern learning.

Parameters:

get_threat_intel

Retrieves current threat intelligence including active detection patterns, threat categories, and statistics.

Parameters:

Response Format

All scan tools return a sanitized response:

{
  "blocked": true,
  "threat_type": "prompt_injection",
  "severity": "high",
  "confidence": "high",
  "guidance": "This prompt contains patterns consistent with instruction override attempts.",
  "request_id": "req_lxyz123_a8f3k2m9"
}

Safe results return:

{
  "blocked": false,
  "request_id": "req_lxyz123_a8f3k2m9"
}

Security Model

This MCP server implements a fail-closed security model:

• Network timeouts result in BLOCK (not allow)
• Backend errors result in BLOCK (not allow)
• Unknown content types result in BLOCK (not allow)

This prevents bypass attacks via service disruption.

Known Limitations

1. Free tier is regex-only — No LLM semantic analysis without API key
2. No offline mode — Requires network access to Shrike backend
3. Response Intelligence requires original prompt — original_prompt param is optional but recommended for full L8 analysis
4. Rate limits are MCP-side only — Backend has separate per-tier limits
5. stdio transport only — No HTTP server mode; requires MCP-compatible host

Self-Hosting

To run your own Shrike backend:

git clone https://github.com/shrike-security/shrike-security-agent.git
cd shrike-security-agent/backend
go run ./cmd/refactored-agent

Then point the MCP server to your local backend:

{
  "mcpServers": {
    "shrike-security": {
      "command": "npx",
      "args": ["shrike-mcp"],
      "env": {
        "SHRIKE_BACKEND_URL": "http://localhost:8080"
      }
    }
  }
}

License

Apache License 2.0 — See LICENSE for details.

Support

• GitHub Issues: https://github.com/Shrike-Security/shrike-mcp/issues
• Email: support@shrikesecurity.com

Changelog

v1.0.0 (February 10, 2026)

• Initial public release
• 7 MCP tools for AI agent security
• 9-layer detection pipeline
• PII isolation with token rehydration
• Response obfuscation for IP protection

Links

• GitHub Repository
• Issue Tracker
• npm Package