MCP Slim Guard
MCP Slim Guard sits between an agent and your MCP servers: it validates calls against schemas and returns big results in parts.
- 180 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The server launches upstream MCP servers using commands from the config and relays agent calls to them.
- Allow rules restrict tools, but a wrong pattern would expose too much.
Install
- Works in
Manual install
{"mcpServers":{"slim-guard":{"command":"mcp-slim-guard","args":["start","--mode","compact"],"cwd":"/absolute/path/to/project"}}}Claude Code entry in Compact mode.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The server launches upstream MCP servers using commands from the config and relays agent calls to them.
- Allow rules restrict tools, but a wrong pattern would expose too much.
This is third-party code. Review the repository files before installing.
What it does
MCP Slim Guard is a proxy for MCP servers. The host connects one server instead of several, while Slim Guard launches the real servers from `mcp-slim-guard.yml`, applies allow and deny lists for tools and validates every call against the original schema before contacting the server. A bad call returns a normal MCP error describing the problem, and the original tool is not invoked. There are three modes. Native shows the host original tool names and full schemas plus `read_result`, Compact keeps three tools (`find_tool`, `call_tool`, `read_result`) with a search returning up to three matches, Extreme adds a shortened first delivery for large results. A large result is stored under a `result_ref` and read in parts through `read_result` without calling the original tool again. It also has SSRF protection, rate limiting, injection detection in results and an audit log.
Who it is for. People who connected many MCP servers to Claude Code or Codex and want to narrow the available tools, cut context size and keep a call log.
Good fit when
- A dozen MCP servers are connected to the agent but only some of their tools are needed.
- A tool result is huge and has to be read in portions without calling again.
- The host wants a small predictable tool set instead of a hundred schemas.
- Server responses are scanned for instruction injection attempts and an audit log is written.
Not a fit when
- A ready npm package is needed: version 0.1.1-alpha.2 is only a source candidate for now.
- Only one server with a couple of tools is connected: the proxy adds an extra hop.
- A check of an already running remote server is needed: Slim Guard starts the upstream servers itself.
Example request
Put my MCP servers behind mcp-slim-guard, allow read access only and deny tools with delete in the name.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
The project is an alpha: version `0.1.1-alpha.2` is not published to npm and is installed from a reviewed copy of the sources (`npm ci`, `npm run build`, `npm link`). Version 1 configuration is not accepted and the `compressor` section was removed. Authorization rules and upstream settings must be reviewed before connecting privileged tools. The last commit in the repository dates from August 2026. The version targets Codex and Claude Code, other hosts are not described in the README. Extreme mode shortens the first delivery only for large results: if it is at least half the size of the full result, the response passes through unchanged.
How to disable. Remove the slim-guard entry from the host configuration and restore direct entries for your MCP servers. For Codex, `mcp-slim-guard plan --host codex` shows the change in advance.
FAQ
How do Native, Compact and Extreme differ?
Native shows the original tools, Compact three generic ones (`find_tool`, `call_tool`, `read_result`), Extreme adds a short first delivery of large results to Compact.
Which mode for Claude Code?
Compact: it is the default for Claude Code. Native is supported for Codex, while Claude Code supports Compact and Extreme.
Is the upstream tool called when arguments are wrong?
No, Slim Guard validates arguments against the original schema and returns an error without contacting the server.
How do I read a big result in full?
Through `read_result` with the `result_ref`: with `query` it finds up to three fragments, without it you follow `next_cursor`.
Is there SSRF and injection protection?
Yes, the configuration has an `ssrf` section (private address blocking, domain lists) and `injection_detection` with a blocking mode.
Discussion
No questions or reviews yet.
Related
MCP serversA self-hosted gateway routes internal MCP tools, authenticates users and records requests for later review.
A self-hosted gateway that merges several MCP servers into one endpoint with auth and tool selection
A WebSSH console for VPS with an MCP server: the agent works across several servers while ACL tokens limit tools and hosts.
A Node.js manager for MCP servers: it starts local servers, connects remote ones and gives a client one address, with a REST API for control
A Proxmox VE MCP server with 341 tools: virtual machines, containers, storage, cluster and backups, with a read-only mode.
MCP SSH Agent is an MCP server that reads hosts from ~/.ssh/config, runs commands and copies files through system ssh and scp.
README in short
The README explains the three modes, a quick start from source, host entries for Codex and Claude Code, the configuration format (allow rules, SSRF, rate limits, injection detection, audit log, the upstream server list), result recovery and quality checks.