MCP DLP with the Guardion plugin

MCP DLP is a local proxy shipped in the @guardion/guardion npm package. Your MCP host (Claude Code, Claude Desktop, Cursor, Windsurf, Cline, VS Code, ChatGPT Desktop, or any stdio MCP client) launches guardion mcp instead of the MCP server; the proxy starts (or connects to) the real server and relays every JSON-RPC message in both directions, scanning and rewriting it in flight.

Detection is done by the Guard API using your policy — the plugin never re-implements detection. What gets redacted (names, contacts, CPF/CNPJ and other government IDs, payment data, secrets, …) is configured once in the Guardion console and applies to every wrapped server.

Prefer to integrate DLP into your own MCP gateway instead of running a local proxy? The plugin is a thin client over two public endpoints — see DLP in your own MCP gateway.

How it works

MCP host  ⇄  guardion mcp (proxy)  ⇄  MCP server (local or remote)
                    │
                    └─ Guard API  (/v1/pii/redact · /v1/pii/unredact · /v1/guard)

When a sensitive value is found, it is replaced with a token such as [GOVERNMENT_ID_3F9A1B2C] and the original is kept in a short-lived, account- and policy-scoped vault. When a token later travels back in the other direction, the proxy restores the original. The model reasons over tokens; the tool receives real values.

Requirements

Quick start

Install the CLI, run the guided setup, then wrap every MCP server the plugin finds in your local MCP config files.

npm install -g @guardion/guardion      # or run any command with: npx -y @guardion/guardion <cmd>

guardion init                          # choose "MCP servers — DLP", paste your key, pick a policy
guardion token test                    # verifies the key against the Guard API

guardion scan --mode mcp --dry-run     # preview which servers will be wrapped
guardion install mcp --policy data-protection   # wrap them (mode defaults to dlp)

guardion scan --mode mcp --revert      # undo: restores the original config

guardion install mcp rewrites the MCP config files it detects — Claude Desktop, Claude Code (~/.claude.json), Cursor (~/.cursor/mcp.json), Windsurf, Cline, ChatGPT Desktop, VS Code (.vscode/mcp.json) and a project .mcp.json. A backup is written next to each file as <file>.guardion.bak, and the rewrite is idempotent. Restart your MCP host after installing.

Wrap a server manually

You can also edit an MCP config yourself: put npx -y @guardion/guardion mcp <flags> -- in front of the original command. Passing the key and policy through the server's env block is the most portable setup and is recommended on macOS and Windows (see Troubleshooting).

{
  "mcpServers": {
    "customers-db": {
      "command": "npx",
      "args": [
        "-y", "@guardion/guardion", "mcp",
        "--mode", "dlp",
        "--trust", "trusted",
        "--server", "customers-db",
        "--policy", "data-protection",
        "--", "node", "./servers/customers-db.js"
      ],
      "env": {
        "GUARDION_TOKEN": "grd_...",
        "GUARDION_POLICY": "data-protection"
      }
    }
  }
}

Remote servers and internal MCP gateways

Remote MCP servers — including an MCP gateway you run internally — are wrapped with --url. Forward any auth the remote needs with one or more --header flags. The transport is inferred (http_forward for Streamable HTTP, sse_bridge for SSE URLs) and can be forced with --transport.

{
  "mcpServers": {
    "internal-gateway": {
      "command": "npx",
      "args": [
        "-y", "@guardion/guardion", "mcp",
        "--mode", "dlp",
        "--trust", "untrusted",
        "--url", "https://mcp.internal.example.com/mcp",
        "--header", "Authorization: Bearer <gateway-token>"
      ],
      "env": {
        "GUARDION_TOKEN": "grd_...",
        "GUARDION_POLICY": "data-protection"
      }
    }
  }
}

To expose the proxy itself as an HTTP MCP endpoint (for hosts that only speak HTTP), add --listen 8900 (binds 127.0.0.1 by default; host:port is accepted). Combined with --url this becomes a local reverse proxy in front of a remote server.

Modes

A blocked call returns a JSON-RPC error to the host: { "code": -32000, "message": "[guardion] blocked — Guardion: <LABEL>" }. Every evaluation (all modes) appears in the console under Observability, tagged with the server and tool name.

Trust direction

--trust decides which side of the proxy is allowed to see real values. Pick it per server.

Worked example (trusted server)

A support agent looks up a customer, then updates their record. The model never sees the real CPF or email, but the database gets the real values.

1. tools/call  get_customer { "id": "8812" }
2. server result   → "Maria Souza, CPF 419.815.118-06, maria@example.com"
3. model receives  → "[PERSON_NAME_A1B2C3D4], CPF [GOVERNMENT_ID_3F9A1B2C], [CONTACT_77E0C1D2]"
4. tools/call  update_customer { "cpf": "[GOVERNMENT_ID_3F9A1B2C]", "status": "active" }
5. server receives → { "cpf": "419.815.118-06", "status": "active" }

The session vault

Each proxy process holds one vault per session: the first redaction mints it and every later redact/restore reuses it, so tokens stay resolvable across tool calls for the lifetime of the session. Set GUARDION_SESSION to pin the session id yourself (for example, to correlate with your own agent session in Observability).

Tokens expire after the vault TTL — 1 hour by default. Set vault_ttl (seconds) in ~/.guardion/config.json to change it. Restarting the MCP host starts a new proxy process and therefore a new session and vault.

Restores are one-time by default: once a token has been restored, it is consumed. If the model reuses the same token in a later call, it reaches the server as the literal token. Design tool flows so each sensitive value is sent back once, or integrate the API directly and disable one-time restore (see DLP in your own MCP gateway).

What is scanned

Binary payloads (data, blob) and metadata (mimeType, annotations, _meta, …) are skipped. Large integers (9+ digits — e.g. an unformatted CPF stored as a number) are scanned as text. Redacted values are written back in place, so the JSON structure the host and server expect is preserved.

CLI flags

Environment variables

Environment variables override ~/.guardion/config.json; CLI flags override both.

Config file

guardion init writes ~/.guardion/config.json. Admins can ship a machine-wide config at /etc/guardion/config.json (%ProgramData%\Guardion\config.json on Windows); user settings override it unless it sets "managed": true.

{
  "version": 1,
  "api_url": "https://api.guardion.ai",
  "policy": "data-protection",
  "application": "mcp",
  "mode": "dlp",
  "trust": "trusted",
  "fail_closed": false,
  "vault_ttl": 3600,
  "hooks": { "timeout_ms": 3000 }
}

Failure behaviour

The proxy is fail-open by default: if the Guard API times out (default 3 s, hooks.timeout_ms), is unreachable or returns an error, the message is forwarded unmodified and your agent keeps working. For regulated data flows, set fail_closed: true (or GUARDION_FAIL_CLOSED=true) — a failed redaction then blocks the call instead of letting raw data through. A failed restore never blocks.

Built-in agent tools (Claude Code)

MCP DLP covers MCP tools. To also mask sensitive output from Claude Code's built-in tools (Read, Bash, WebFetch, Grep, …), install the hooks: guardion claude-code --mode hooks --redact (add --enforce to block on a policy deny). Hook redaction is one-way masking of tool output; MCP tool output is left to the proxy. See CLI agent hooks.

Troubleshooting