Laraguard Mcp

by ecr17dev

153 downloads

Not rated

GitHub

Other

Description

# Laraguard MCP <img width="100%" alt="image" src="https://github.com/user-attachments/assets/27731e3b-2a15-4b1a-b2e3-c76fca96fff5" /> > **A security audit MCP server for Laravel projects — built with TypeScript and stdio transport.** [![License…

About

Details

Author: ecr17dev
Downloads: 153
Categories: Other

- Static code scanning with 15+ rules covering SQL injection, RCE, hardcoded credentials, and LFI
- Blade XSS scanner that detects unescaped output in templates
- Route and middleware audit for missing auth, throttle, or CSRF exceptions
- Dependency CVE feed querying the OSV.dev batch API for real vulnerabilities
- Configuration audit inspecting .env and config/cors.php for critical misconfigurations
- Active attack simulation firing live HTTP probes (SQLi, XSS, CSRF, auth bypass, rate limiting)

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Laraguard Mcp

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

From the repository

Clone the repository, install dependencies with npm install, and optionally configure environment variables (e.g., MCP_BASE_PATHS). Then add a laraguard entry to your MCP client’s configuration (JSON block with command node pointing to dist/index.js, or npx tsx pointing to src/index.ts under development). Tools are invoked by sending tool calls like project_info, full_audit, or attack_simulate with a path and optional baseUrl.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

McpServers

{
    "laraguard": {
        "command": "node",
        "args": [
            "/absolute/path/to/Laraguard MCP/dist/index.js"
        ],
        "env": {
            "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
        }
    }
}

Laraguard MCP

> A security audit MCP server for Laravel projects — built with TypeScript and stdio transport.

---

Overview

Laraguard MCP is a standalone Model Context Protocol (MCP) server that performs security audits on Laravel projects. It is implemented in pure TypeScript using the official @modelcontextprotocol/sdk and communicates over stdio, making it natively compatible with any MCP-capable IDE or client (Cursor, Claude Desktop, VS Code MCP extensions, etc.). The server analyses a Laravel project as an external target — it does not require Laravel to be running. It returns structured JSON findings categorised by severity, covering configuration issues, risky code patterns, and dependency hygiene. ---

Features

- 🔍 Static code scanning — 15+ rules covering SQL injection, RCE, hardcoded credentials, weak crypto, mass assignment, and LFI - 🎭 Blade XSS scanner — detects unescaped {!! !!} output and raw input rendering in templates - 🛣️ Route & middleware audit — flags admin routes without auth, API routes without auth:sanctum, login routes without throttle, and CSRF exceptions - 📦 Dependency CVE feed — queries the OSV.dev API for real CVEs across all composer.lock packages - ⚙️ Configuration audit — inspects .env (DEBUG, APP_KEY, APP_ENV, secure cookies) and config/cors.php - 🗂️ Project metadata — reads composer.json to identify Laravel and PHP version constraints - 💥 Active attack simulation — fires HTTP probes (SQL injection, XSS, CSRF, auth bypass, rate limiting) against a running app - 🔒 Path traversal prevention — strict allowlist enforcement for all file operations - ✂️ Secret redaction — sensitive values are masked in textual output before reaching the MCP client - 🚀 stdio transport — zero-config network; works inside any IDE that supports MCP ---

MCP Tools

The server exposes 8 tools. All static tools accept a single path parameter. attack_simulate additionally requires a baseUrl. | Tool | Input | Description | |------|-------|-------------| | project_info | path | Returns metadata from composer.json: project name, Laravel/PHP version constraints, engine info. | | dependency_audit | path | Parses composer.lock and queries OSV.dev for real CVEs with severity and fix versions. | | config_audit | path | Inspects .env (DEBUG, APP_KEY, APP_ENV, session cookies) and config/cors.php (wildcard origins). | | code_scan | path | 15+ static pattern rules across all PHP files — credentials, weak crypto, mass assignment, RCE, LFI, SQL injection. | | blade_scan | path | Scans resources/views/ Blade templates for unescaped output ({!! !!}) and XSS-prone patterns. | | route_audit | path | Audits route files and middleware for missing auth, missing throttle, and CSRF exception wildcards. | | attack_simulate | path + baseUrl | Fires 6 live HTTP probes against a running app: SQL injection, XSS, CSRF, auth bypass, rate limiting, error disclosure. | | full_audit | path | Runs dependency_audit + config_audit + code_scan + blade_scan + route_audit in parallel and returns a consolidated report. |

Code Scan — Detected Patterns

| Pattern | Severity | Finding Type | |---------|----------|--------------| | ->whereRaw( | High | SQL_INJECTION | | DB::raw( | Medium | RAW_SQL_USAGE | | unserialize( | Critical | UNSAFE_UNSERIALIZE | | shell_exec( / exec( / system( / passthru( | Critical | RCE_RISK | | eval( | Critical | EVAL_USAGE | | password = 'literal' | Critical | HARDCODED_PASSWORD | | api_key = 'literal' | Critical | HARDCODED_API_KEY | | Long hardcoded tokens/secrets | High | HARDCODED_SECRET | | md5( | High | WEAK_HASH_MD5 | | sha1( | Medium | WEAK_HASH_SHA1 | | protected $guarded = [] | High | MASS_ASSIGNMENT_UNGUARDED | | file_get_contents($request…) | Critical | PATH_TRAVERSAL_RISK | | include/require($request…) | Critical | LFI_RISK |

Audit Report Schema

Every tool returns a structured JSON report: ``

json
{
  "summary": {
    "critical": 0,
    "high": 1,
    "medium": 2,
    "low": 0,
    "info": 1
  },
  "findings": [
    {
      "severity": "high",
      "type": "SQL_INJECTION",
      "title": "Potential SQL injection via whereRaw",
      "file": "app/Http/Controllers/UserController.php",
      "line": 42,
      "evidence": "->whereRaw('email = ' . $email)",
      "recommendation": "Avoid raw SQL with user input. Use parameter binding/query builder."
    }
  ],
  "metadata": {
    "scannedPath": "/absolute/path/to/laravel-project",
    "engine": "Laraguard MCP",
    "version": "3.0.0",
    "timestamp": "2025-01-01T00:00:00.000Z",
    "durationMs": 312
  }
}



---

Architecture


src/
├── index.ts      — MCP server bootstrap and tool registration
├── config.ts     — Environment variable loading and validation
├── security.ts   — Path allowlist enforcement and secret redaction
├── files.ts      — Safe file enumeration and reading
├── tools.ts      — Audit tool implementations
├── reports.ts    — Report aggregation and severity summarization
└── types.ts      — Domain types (Finding, AuditReport, Severity, etc.)



Runtime stack:

| Component | Technology |
|-----------|------------|
| Runtime | Node.js 20+ |
| Language | TypeScript 5.x |
| Protocol | Model Context Protocol (MCP) |
| Transport |

stdio

 |
| Schema validation | Zod |
| MCP SDK |

@modelcontextprotocol/sdk

 |

---

Requirements


- Node.js 20 or higher
- npm 10 or higher

Verify your environment:

bash
node -v
npm -v



---

Installation


Clone the repository and install dependencies:

bash
git clone https://github.com/ecr17dev/Laraguard-MCP.git
cd "Laraguard MCP"
npm install



---

Configuration


Copy the example environment file and customise it:

bash
cp .env.example .env



Environment Variables


| Variable | Default | Description |
|----------|---------|-------------|
|

MCP_BASE_PATH

 | — | Single allowed root path for project scanning. |
|

MCP_BASE_PATHS | — | Comma-separated list of allowed root paths. Takes precedence over MCP_BASE_PATH

. |
|

MCP_MAX_FILES | 5000

 | Maximum number of files to enumerate per scan. |
|

MCP_MAX_FILE_SIZE_BYTES | 300000

 | Maximum file size (in bytes) to read per file. |
|

MCP_TIMEOUT_SECONDS | 30

 | Logical timeout for audit operations. |

> Priority order:

MCP_BASE_PATHS → MCP_BASE_PATH

 → current working directory.

`Example` .env

``env

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

Description

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

Laraguard MCP

Overview

Features

MCP Tools

Code Scan — Detected Patterns

Audit Report Schema

Architecture

Requirements

Installation

Configuration

Environment Variables

Example .env

Install

More like this

Sequential Thinking

Filesystem

EverArt

Google Drive

Reactive Resume

FastMCP v2 🚀

`Example` .env