Do I need MCP-guard software?
If you run any MCP servers in production, yes. The April 2026 design-level RCE affected 200,000+ servers and the protocol's implicit-trust model gives every server full agent context. mcp-guard (Securie) + mcp-scan (Invariant Labs) are the table-stakes defense.
MCP's protocol design optimised for fast local-tool dispatch and treated the server's catalog as authoritative. That implicit trust is exploitable in four ways (unknown-server smuggle, fingerprint drift, tool smuggle, scope escalation) — all four were demonstrated against production MCP deployments in the April 2026 wave.
Securie's mcp-guard crate (`crates/mcp-guard/src/lib.rs`) is the runtime enforcement layer: TrustedCatalog (operator-pinned allow-list) + Validator (per-manifest invariant checks) + ScopeGuard (per-dispatch O(1) scope check). Wiring is `Router::with_mcp_guard(scope_guard)` at agent construction time — no per-call code change.
Invariant Labs' open-source `mcp-scan` runs as a periodic fleet check + complements mcp-guard's runtime enforcement.