README.md
A security audit MCP server for Laravel projects
Laraguard MCP
A security audit MCP server for Laravel projects — built with TypeScript and stdio transport.
Overview
Laraguard MCP is a standalone Model Context Protocol (MCP) server that performs security audits on Laravel projects. It is implemented in pure TypeScript using the official @modelcontextprotocol/sdk and communicates over stdio, making it natively compatible with any MCP-capable IDE or client (Cursor, Claude Desktop, VS Code MCP extensions, etc.).
The server analyses a Laravel project as an external target — it does not require Laravel to be running. It returns structured JSON findings categorised by severity, covering configuration issues, risky code patterns, and dependency hygiene.
Features
- 🔍 Static code scanning — 15+ rules covering SQL injection, RCE, hardcoded credentials, weak crypto, mass assignment, and LFI
- 🎭 Blade XSS scanner — detects unescaped
{!! !!}output and raw input rendering in templates - 🛣️ Route & middleware audit — flags admin routes without auth, API routes without auth:sanctum, login routes without throttle, and CSRF exceptions
- 📦 Dependency CVE feed — queries the OSV.dev API for real CVEs across all
composer.lockpackages - ⚙️ Configuration audit — inspects
.env(DEBUG, APP_KEY, APP_ENV, secure cookies) andconfig/cors.php - 🗂️ Project metadata — reads
composer.jsonto identify Laravel and PHP version constraints - 💥 Active attack simulation — fires HTTP probes (SQL injection, XSS, CSRF, auth bypass, rate limiting) against a running app
- 🔒 Path traversal prevention — strict allowlist enforcement for all file operations
- ✂️ Secret redaction — sensitive values are masked in textual output before reaching the MCP client
- 🚀 stdio transport — zero-config network; works inside any IDE that supports MCP
MCP Tools
The server exposes 8 tools. All static tools accept a single path parameter. attack_simulate additionally requires a baseUrl.
| Tool | Input | Description |
|---|---|---|
project_info |
path |
Returns metadata from composer.json: project name, Laravel/PHP version constraints, engine info. |
dependency_audit |
path |
Parses composer.lock and queries OSV.dev for real CVEs with severity and fix versions. |
config_audit |
path |
Inspects .env (DEBUG, APP_KEY, APP_ENV, session cookies) and config/cors.php (wildcard origins). |
code_scan |
path |
15+ static pattern rules across all PHP files — credentials, weak crypto, mass assignment, RCE, LFI, SQL injection. |
blade_scan |
path |
Scans resources/views/ Blade templates for unescaped output ({!! !!}) and XSS-prone patterns. |
route_audit |
path |
Audits route files and middleware for missing auth, missing throttle, and CSRF exception wildcards. |
attack_simulate |
path + baseUrl |
Fires 6 live HTTP probes against a running app: SQL injection, XSS, CSRF, auth bypass, rate limiting, error disclosure. |
full_audit |
path |
Runs dependency_audit + config_audit + code_scan + blade_scan + route_audit in parallel and returns a consolidated report. |
Code Scan — Detected Patterns
| Pattern | Severity | Finding Type |
|---|---|---|
->whereRaw( |
High | SQL_INJECTION |
DB::raw( |
Medium | RAW_SQL_USAGE |
unserialize( |
Critical | UNSAFE_UNSERIALIZE |
shell_exec( / exec( / system( / passthru( |
Critical | RCE_RISK |
eval( |
Critical | EVAL_USAGE |
password = 'literal' |
Critical | HARDCODED_PASSWORD |
api_key = 'literal' |
Critical | HARDCODED_API_KEY |
| Long hardcoded tokens/secrets | High | HARDCODED_SECRET |
md5( |
High | WEAK_HASH_MD5 |
sha1( |
Medium | WEAK_HASH_SHA1 |
protected $guarded = [] |
High | MASS_ASSIGNMENT_UNGUARDED |
file_get_contents($request…) |
Critical | PATH_TRAVERSAL_RISK |
include/require($request…) |
Critical | LFI_RISK |
Audit Report Schema
Every tool returns a structured JSON report:
{
"summary": {
"critical": 0,
"high": 1,
"medium": 2,
"low": 0,
"info": 1
},
"findings": [
{
"severity": "high",
"type": "SQL_INJECTION",
"title": "Potential SQL injection vi
Tools (8)
project_infoReturns metadata from composer.json including project name, Laravel/PHP version constraints, and engine info.dependency_auditParses composer.lock and queries OSV.dev for real CVEs with severity and fix versions.config_auditInspects .env and config/cors.php for security issues like debug mode or wildcard origins.code_scanPerforms static pattern analysis across PHP files to detect vulnerabilities like SQL injection, RCE, and hardcoded credentials.blade_scanScans Blade templates for unescaped output and XSS-prone patterns.route_auditAudits route files and middleware for missing authentication, missing throttling, and CSRF exceptions.attack_simulateFires live HTTP probes against a running app to test for SQL injection, XSS, CSRF, auth bypass, and rate limiting.full_auditRuns all security audits in parallel and returns a consolidated report.Configuration
claude_desktop_config.json
{"mcpServers": {"laraguard": {"command": "npx", "args": ["-y", "laraguard-mcp"]}}}Try it
→Run a full security audit on my current Laravel project directory.
→Check my composer.lock file for any known CVEs in my dependencies.
→Scan my Blade templates for potential XSS vulnerabilities.
→Perform a code scan on the project to identify any hardcoded secrets or SQL injection risks.
→Simulate an attack on my local Laravel app running at http://localhost:8000 to test for auth bypass.