MCP Defender

If you've wired MCP servers into Cursor or Claude, you've probably wondered what happens when a tool call goes rogue. MCP Defender answers that with a local proxy that inspects every call before it hits your machine. The LLM-plus-signatures approach is smart: it catches both known attack patterns and novel ones that only a language model would spot. And since it's open source, you can actually audit the detection rules instead of trusting a black box. What we like most is the control. You choose your own LLM provider, you manage your own signatures, and everything stays on your desktop. No cloud round-trips, no data leaving your perimeter. That's a big deal for security teams who can't ship code to an external service. The Docker acquisition adds a safety net — you're not betting on a tiny startup to keep the project alive. Where it bites: the free tier caps at 250 transactions, which sounds generous until you realize a busy CI session can burn through that in a day. The $29.99 Basic plan is where the real value is, and it's priced fairly for what it does. But there's no cloud option, so if you want a fleet-wide monitor or SIEM integration, you'll have to build that yourself. In practice, this is a developer tool with a security mindset, not an enterprise-grade SOC platform. You'll use it alongside your existing security stack, not instead of it. The dashboard is functional but not fancy — it shows scans and lets you tweak signatures, but don't expect deep analytics. For most MCP-heavy developers, that's enough. Compared to rolling your own proxy or skipping protection altogether, MCP Defender is a no-brainer for anyone serious about AI safety. If you're on a zero budget with low volume, the free tier works. If you're a team, pay for Basic. Just don't expect it to