# mcpgawk MCP server

> Provides a local gateway to monitor, verify, and block unauthorized tool changes in Model Context Protocol servers.

- Repository: https://github.com/gawk-dev/mcpgawk
- Page: https://hostedmcp.org/servers/gawk-dev/mcpgawk
- Transport: stdio
- Stars: 1
- License: Apache-2.0
- Latest version: 0.1.87

## Install

### Claude Code

```sh
claude mcp add mcpgawk -- uvx mcpgawk
```

### Cursor (`~/.cursor/mcp.json`)

```json
{
  "mcpServers": {
    "mcpgawk": {
      "command": "uvx",
      "args": [
        "mcpgawk"
      ]
    }
  }
}
```

### VS Code (`.vscode/mcp.json`)

```json
{
  "servers": {
    "mcpgawk": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "mcpgawk"
      ]
    }
  }
}
```

### Claude Desktop (`claude_desktop_config.json`)

```json
{
  "mcpServers": {
    "mcpgawk": {
      "command": "uvx",
      "args": [
        "mcpgawk"
      ]
    }
  }
}
```

### Codex (`~/.codex/config.toml`)

```toml
[mcp_servers.mcpgawk]
command = "uvx"
args = ["mcpgawk"]
```

### Gemini CLI (`~/.gemini/settings.json`)

```json
{
  "mcpServers": {
    "mcpgawk": {
      "command": "uvx",
      "args": [
        "mcpgawk"
      ]
    }
  }
}
```

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `GITHUB_PERSONAL_ACCESS_TOKEN` | no | no |  |

## FAQ

### Does mcpgawk upload my data to the cloud?

No, it is a local-first tool that runs on your machine and uploads nothing.

### How does mcpgawk handle tool changes?

It reads every server, checks calls against an approved baseline, and blocks tools that have changed.

### Can I use it to test for security vulnerabilities?

Yes, the verify command drives tools in a sandbox to report on exfiltration, SSRF, and tool poisoning.

### What happens if a tool is skipped during a scan?

Skipped tools are explicitly named as skipped rather than being counted as clean.