Laraguard Mcp

by ecr17dev

153 downloads Not rated yet

GitHub

Other

About

# Laraguard MCP <img width="100%" alt="image" src="https://github.com/user-attachments/assets/27731e3b-2a15-4b1a-b2e3-c76fca96fff5" /> > **A security audit MCP server for Laravel projects — built with TypeScript and stdio transport.** [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE)…

Explore

- 🔍 Static code scanning — 15+ rules covering SQL injection, RCE, hardcoded credentials, weak crypto, mass assignment, and LFI
- 🎭 Blade XSS scanner — detects unescaped {!! !!} output and raw input rendering in templates
- 🛣️ Route & middleware audit — flags admin routes without auth, API routes without auth:sanctum, login routes without throttle, and CSRF exceptions
- 📦 Dependency CVE feed — queries the OSV.dev API for real CVEs across all composer.lock packages
- ⚙️ Configuration audit — inspects .env (DEBUG, APP_KEY, APP_ENV, secure cookies) and config/cors.php
- 🗂️ Project metadata — reads composer.json to identify Laravel and PHP version constraints
- 💥 Active attack simulation — fires HTTP probes (SQL injection, XSS, CSRF, auth bypass, rate limiting) against a running app
- 🔒 Path traversal prevention — strict allowlist enforcement for all file operations
- ✂️ Secret redaction — sensitive values are masked in textual output before reaching the MCP client
- 🚀 stdio transport — zero-config network; works inside any IDE that supports MCP

---

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Laraguard Mcp

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

From the repository

- Node.js 20 or higher
- npm 10 or higher

Verify your environment:

``bash node -v npm -v`---

| Variable | Default | Description | |----------|---------|-------------| |MCP_BASE_PATH| — | Single allowed root path for project scanning. | |MCP_BASE_PATHS | — | Comma-separated list of allowed root paths. Takes precedence over MCP_BASE_PATH. | |MCP_MAX_FILES | 5000| Maximum number of files to enumerate per scan. | |MCP_MAX_FILE_SIZE_BYTES | 300000| Maximum file size (in bytes) to read per file. | |MCP_TIMEOUT_SECONDS | 30| Logical timeout for audit operations. | > Priority order:MCP_BASE_PATHS → MCP_BASE_PATH → current working directory.

`bash npm run dev



Add the following to your MCP client's configuration file, replacing the path with the absolute path to your installation:

json

{

  "mcpServers": {

    "laraguard": {

      "command": "node",

      "args": ["/absolute/path/to/Laraguard MCP/dist/index.js"],

      "env": {

        "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"

      }

    }

  }

}



json

{ "path": "/absolute/path/to/laravel-project" }





| Check | File | Severity |

|-------|------|----------|

|

APP_DEBUG=true | .env

 | High |

|

APP_ENV=local | .env

 | Medium |

|

APP_KEY= (empty) | .env

 | Critical |

|

SESSION_SECURE_COOKIE=false | .env

 | Medium |

| Wildcard CORS origin (

'*') | config/cors.php` | Medium |

---

`project_info`

`path`

`dependency_audit`

`path`

`config_audit`

`path`

`code_scan`

`path`

`blade_scan`

`path`

`route_audit`

`path`

`attack_simulate`

`path` + `baseUrl`

`full_audit`

`path`

The server exposes 8 tools. All static tools accept a single path parameter. attack_simulate additionally requires a baseUrl.

| Tool | Input | Description |
|------|-------|-------------|
| project_info | path | Returns metadata from composer.json: project name, Laravel/PHP version constraints, engine info. |
| dependency_audit | path | Parses composer.lock and queries OSV.dev for real CVEs with severity and fix versions. |
| config_audit | path | Inspects .env (DEBUG, APP_KEY, APP_ENV, session cookies) and config/cors.php (wildcard origins). |
| code_scan | path | 15+ static pattern rules across all PHP files — credentials, weak crypto, mass assignment, RCE, LFI, SQL injection. |
| blade_scan | path | Scans resources/views/ Blade templates for unescaped output ({!! !!}) and XSS-prone patterns. |
| route_audit | path | Audits route files and middleware for missing auth, missing throttle, and CSRF exception wildcards. |
| attack_simulate | path + baseUrl | Fires 6 live HTTP probes against a running app: SQL injection, XSS, CSRF, auth bypass, rate limiting, error disclosure. |
| full_audit | path | Runs dependency_audit + config_audit + code_scan + blade_scan + route_audit in parallel and returns a consolidated report. |

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "laraguard mcp": {
            "laraguard": {
                "command": "node",
                "args": [
                    "/absolute/path/to/Laraguard MCP/dist/index.js"
                ],
                "env": {
                    "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
                }
            }
        }
    }
}

McpServers

{
    "laraguard": {
        "command": "node",
        "args": [
            "/absolute/path/to/Laraguard MCP/dist/index.js"
        ],
        "env": {
            "MCP_BASE_PATHS": "/absolute/path/to/your-laravel-project"
        }
    }
}

> A security audit MCP server for Laravel projects — built with TypeScript and stdio transport.

---

Overview

Laraguard MCP is a standalone Model Context Protocol (MCP) server that performs security audits on Laravel projects. It is implemented in pure TypeScript using the official @modelcontextprotocol/sdk and communicates over stdio, making it natively compatible with any MCP-capable IDE or client (Cursor, Claude Desktop, VS Code MCP extensions, etc.). The server analyses a Laravel project as an external target — it does not require Laravel to be running. It returns structured JSON findings categorised by severity, covering configuration issues, risky code patterns, and dependency hygiene. ---

Features

- 🔍 Static code scanning — 15+ rules covering SQL injection, RCE, hardcoded credentials, weak crypto, mass assignment, and LFI - 🎭 Blade XSS scanner — detects unescaped {!! !!} output and raw input rendering in templates - 🛣️ Route & middleware audit — flags admin routes without auth, API routes without auth:sanctum, login routes without throttle, and CSRF exceptions - 📦 Dependency CVE feed — queries the OSV.dev API for real CVEs across all composer.lock packages - ⚙️ Configuration audit — inspects .env (DEBUG, APP_KEY, APP_ENV, secure cookies) and config/cors.php - 🗂️ Project metadata — reads composer.json to identify Laravel and PHP version constraints - 💥 Active attack simulation — fires HTTP probes (SQL injection, XSS, CSRF, auth bypass, rate limiting) against a running app - 🔒 Path traversal prevention — strict allowlist enforcement for all file operations - ✂️ Secret redaction — sensitive values are masked in textual output before reaching the MCP client - 🚀 stdio transport — zero-config network; works inside any IDE that supports MCP ---

MCP Tools

The server exposes 8 tools. All static tools accept a single path parameter. attack_simulate additionally requires a baseUrl. | Tool | Input | Description | |------|-------|-------------| | project_info | path | Returns metadata from composer.json: project name, Laravel/PHP version constraints, engine info. | | dependency_audit | path | Parses composer.lock and queries OSV.dev for real CVEs with severity and fix versions. | | config_audit | path | Inspects .env (DEBUG, APP_KEY, APP_ENV, session cookies) and config/cors.php (wildcard origins). | | code_scan | path | 15+ static pattern rules across all PHP files — credentials, weak crypto, mass assignment, RCE, LFI, SQL injection. | | blade_scan | path | Scans resources/views/ Blade templates for unescaped output ({!! !!}) and XSS-prone patterns. | | route_audit | path | Audits route files and middleware for missing auth, missing throttle, and CSRF exception wildcards. | | attack_simulate | path + baseUrl | Fires 6 live HTTP probes against a running app: SQL injection, XSS, CSRF, auth bypass, rate limiting, error disclosure. | | full_audit | path | Runs dependency_audit + config_audit + code_scan + blade_scan + route_audit in parallel and returns a consolidated report. |

Code Scan — Detected Patterns

| Pattern | Severity | Finding Type | |---------|----------|--------------| | ->whereRaw( | High | SQL_INJECTION | | DB::raw( | Medium | RAW_SQL_USAGE | | unserialize( | Critical | UNSAFE_UNSERIALIZE | | shell_exec( / exec( / system( / passthru( | Critical | RCE_RISK | | eval( | Critical | EVAL_USAGE | | password = 'literal' | Critical | HARDCODED_PASSWORD | | api_key = 'literal' | Critical | HARDCODED_API_KEY | | Long hardcoded tokens/secrets | High | HARDCODED_SECRET | | md5( | High | WEAK_HASH_MD5 | | sha1( | Medium | WEAK_HASH_SHA1 | | protected $guarded = [] | High | MASS_ASSIGNMENT_UNGUARDED | | file_get_contents($request…) | Critical | PATH_TRAVERSAL_RISK | | include/require($request…) | Critical | LFI_RISK |

Audit Report Schema

Every tool returns a structured JSON report: ``

json
{
  "summary": {
    "critical": 0,
    "high": 1,
    "medium": 2,
    "low": 0,
    "info": 1
  },
  "findings": [
    {
      "severity": "high",
      "type": "SQL_INJECTION",
      "title": "Potential SQL injection via whereRaw",
      "file": "app/Http/Controllers/UserController.php",
      "line": 42,
      "evidence": "->whereRaw('email = ' . $email)",
      "recommendation": "Avoid raw SQL with user input. Use parameter binding/query builder."
    }
  ],
  "metadata": {
    "scannedPath": "/absolute/path/to/laravel-project",
    "engine": "Laraguard MCP",
    "version": "3.0.0",
    "timestamp": "2025-01-01T00:00:00.000Z",
    "durationMs": 312
  }
}



---

Architecture


src/
├── index.ts      — MCP server bootstrap and tool registration
├── config.ts     — Environment variable loading and validation
├── security.ts   — Path allowlist enforcement and secret redaction
├── files.ts      — Safe file enumeration and reading
├── tools.ts      — Audit tool implementations
├── reports.ts    — Report aggregation and severity summarization
└── types.ts      — Domain types (Finding, AuditReport, Severity, etc.)



Runtime stack:

| Component | Technology |
|-----------|------------|
| Runtime | Node.js 20+ |
| Language | TypeScript 5.x |
| Protocol | Model Context Protocol (MCP) |
| Transport |

stdio

 |
| Schema validation | Zod |
| MCP SDK |

@modelcontextprotocol/sdk

 |

---

Requirements


- Node.js 20 or higher
- npm 10 or higher

Verify your environment:

bash
node -v
npm -v



---

Installation


Clone the repository and install dependencies:

bash
git clone https://github.com/ecr17dev/Laraguard-MCP.git
cd "Laraguard MCP"
npm install



---

Configuration


Copy the example environment file and customise it:

bash
cp .env.example .env



Environment Variables


| Variable | Default | Description |
|----------|---------|-------------|
|

MCP_BASE_PATH

 | — | Single allowed root path for project scanning. |
|

MCP_BASE_PATHS | — | Comma-separated list of allowed root paths. Takes precedence over MCP_BASE_PATH

. |
|

MCP_MAX_FILES | 5000

 | Maximum number of files to enumerate per scan. |
|

MCP_MAX_FILE_SIZE_BYTES | 300000

 | Maximum file size (in bytes) to read per file. |
|

MCP_TIMEOUT_SECONDS | 30

 | Logical timeout for audit operations. |

> Priority order:

MCP_BASE_PATHS → MCP_BASE_PATH

 → current working directory.

`Example` .env

``env

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Explore

Setting up with Highlight

From the repository

project_info

dependency_audit

config_audit

code_scan

blade_scan

route_audit

attack_simulate

full_audit

Claude Desktop / Cursor

McpServers

Overview

Features

MCP Tools

Code Scan — Detected Patterns

Audit Report Schema

Architecture

Requirements

Installation

Configuration

Environment Variables

Example .env

More like this

Sequential Thinking

Filesystem

EverArt

Google Drive

`project_info`

`dependency_audit`

`config_audit`

`code_scan`

`blade_scan`

`route_audit`

`attack_simulate`

`full_audit`

`Example` .env