Glyph

🔮 Glyph — MCP Security Scanner & Runtime Proxy

Read the runes before your agent steps on them.

Dual-mode MCP security platform.Scan configurations statically + protect traffic at runtime. 83% detection on research attack corpus. 100% on real-world CVEs. Zero false positives.

Glyph guards your MCP infrastructure through two complementary approaches:

🔍 Static Analysis(glyph scan) — Deep security scan of MCP configuration files
🛡️ Runtime Protection(glyph proxy) — Live interception and sanitization of MCP traffic

Static finds the vulnerabilities. Runtime stops the exploits. Together, they create comprehensive MCP security.

# Install pip install glyph-scan # Static scan — analyze config files glyph scan ~/.config/claude/claude_desktop_config.json # Runtime protection — proxy live traffic glyph baseline create config.json # Create security baseline glyph proxy config.json --baseline baseline.json

Results in seconds. No cloud API required. No account needed.

14 Security Rules— 7 static + 7 runtime

Real-world validation against actual exploits:

✅marmelab/mcp-vulnerability— Prompt injection + cross-tool hijacking PoC
✅Invariant Labs GitHub MCP— Issue description data exfiltration
✅Anthropic Git MCP RCE— Command injection via git config manipulation
✅WhatsApp MCP Exfil— Hidden message backup to external endpoint
✅ToolHijacker Academic— Biased tool selection manipulation

- 83%detection rate on 23-vector research attack corpus
- 100%detection rate on real-world CVE patterns
- 0false positives on legitimate tool descriptions
- 197test cases passing

Not synthetic benchmarks. Real exploits that target real MCP deployments.

# Scan a single config glyph scan ~/.config/claude/claude_desktop_config.json # JSON output for CI/CD glyph scan config.json --format json # Filter by severity glyph scan config.json --severity critical # List all detection rules glyph rules list

# 1. Create security baseline (approved tool definitions) glyph baseline create config.json --output baseline.json # 2. Run as security proxy glyph proxy config.json --baseline baseline.json # 3. Manage quarantined responses glyph quarantine list glyph quarantine release <id> # 4. Analyze traffic logs glyph traffic list glyph traffic search "suspicious" glyph traffic stats

- Client connects to Glyph proxy
- Proxy establishes upstream connection to real MCP server
- Proxy scans tool definitions against baseline (rug pull detection)
- Client tool calls → Proxy → Security rules → Server
- Server response → Proxy → Security rules + ANSI sanitization → Client
- Suspicious responses quarantined for review

🔮 Glyph v0.3.0 — MCP Security Scanner & Runtime Proxy Scanning: config.json (3 servers, 12 tools) ━━━ Findings ━━━ 🔴 CRITICAL: Semantic poisoning detected Rule: semantic-poisoning (confidence: 0.94) Location: tool "helper" in server "utils" Similarity: 94% match to known prompt injection pattern Fix: Review tool description for hidden instructions 🔴 CRITICAL: Data exfiltration pattern Rule: data-exfiltration Location: tool "email_sender" in server "comms" Pattern: Hidden BCC to external domain Fix: Remove hardcoded recipient addresses 🟡 HIGH: Hardcoded API key Rule: credential-exposure Location: server "openai-tools" Fix: Use ${OPENAI_API_KEY} environment variable ━━━ Summary ━━━ Scanned: 1 config, 3 servers, 12 tools Findings: 2 critical, 1 high, 0 medium, 0 low Status: FAIL (CRITICAL findings detected)

┌─────────────┐ JSON-RPC ┌─────────────┐ JSON-RPC ┌─────────────┐ │ Client │ ←────────→ │Glyph Proxy │ ←────────→ │ MCP Server │ │ (Claude AI) │ │ │ │ (Tools) │ └─────────────┘ └─────────────┘ └─────────────┘ │ ┌───────┼───────┐ │ │ │ ┌───────▼──┐ ┌──▼───┐ ┌─▼─────────┐ │Static │ │Runtime│ │Quarantine │ │Engine │ │Rules │ │System │ │(7 rules) │ │(7 rules)│ │(SQLite) │ └──────────┘ └───────┘ └───────────┘

Static Engine— Analyze configurations for known vulnerabilities
Runtime Rules— Real-time traffic analysis and threat detection
Quarantine System— Safe storage and review of suspicious responses
ONNX Semantic Analysis— ML-powered intent detection via embeddings

⚠️Runtime scanning spawns processesdefined in config files. A malicious config can contain arbitrary commands. Static scanning is safe (JSON parsing only).

# Safe: static configuration analysis glyph scan config.json # Caution: live server connections (spawns processes) glyph proxy config.json --baseline baseline.json # Sandboxed live scanning (recommended for untrusted configs) docker run --rm -v $(pwd):/scan glyph proxy /scan/config.json --baseline /scan/baseline.json

git clone https://github.com/HaseebKhalid1507/glyph.git cd glyph pip install -e ".[dev]" pytest tests/ -v

- 10,074 lines of code
- 197 test cases
- 83% detection rate on adversarial research corpus
- 14 detection rules (7 static + 7 runtime)
- 0 external dependencies for core scanning

- Browser Extension— scan MCP configs in Claude Desktop GUI
- GitHub Action— automated PR scanning for MCP configurations
- SARIF Output— security tool integration (SonarQube, CodeQL)
- WebSocket Transport— support for WebSocket-based MCP servers
- Enterprise Dashboard— centralized security monitoring

Found a new MCP attack pattern? Open an issue with details.
Want to add detection rules? PRs welcome.
Need enterprise features? Let's talk.

Built byHaseeb Khalid— security engineer, agent builder, rune reader.

Arcjet is the runtime security platform that ships with your AI code.