MCP-Dandan

Overview

MCP-Dandan is an integrated security solution designed to monitor MCP (Model Context Protocol) communications and detect security threats in real-time. It features a modern Electron-based desktop UI that provides an interactive dashboard for monitoring MCP traffic, analyzing threats, and controlling blocking actions. The framework includes multiple detection engines: command injection detection, file system exposure detection, PII leak detection, data exfiltration detection, and tools poisoning detection using LLM-based semantic analysis. The system supports cross-platform operation on Windows, macOS, and Linux, with customizable detection rules and a user-friendly interface for managing security alerts.

Try asking AI

After installing, here are 5 things you can ask your AI assistant:

• detect_command_injection

  Detects potential command injection patterns in tool calls

  Try:Check if this command injection attempt is detectedTry:Analyze this tool call for command injection risks
• detect_file_system_exposure

  Monitors unauthorized file system access attempts

  Try:Detect suspicious file access patternsTry:Check for unauthorized file system operations
• detect_pii_leak

  Detects potential PII leakage with built-in and custom rules

  Try:Check if this data contains PIITry:Analyze this output for personal information exposure
• detect_data_exfiltration

  Identifies suspicious data transfer patterns

  Try:Detect unusual data transfersTry:Check if this communication represents data exfiltration
• analyze_tool_poisoning

  Scores tool usage alignment with specifications to detect poisoning

  Try:Analyze this tool call for poisoning risksTry:Check alignment between tool specification and usage

Note: Tool names inferred from detection engine descriptions, as no explicit tool documentation was provided

Comparable tools

Installation

# Clone the repository
git clone https://github.com/82ch/MCP-Dandan.git
cd MCP-Dandan

# Install all dependencies (Python + Node.js)
npm run install-all

# Start both server and desktop UI
npm run dev

{
  "mcpServers": {
    "mcp-dandan": {
      "command": "python",
      "args": ["path/to/mcp-dandan/server.py"]
    }
  }
}

FAQ

What security threats does MCP-Dandan detect?

MCP-Dandan detects multiple types of threats including command injection attempts, file system exposure, PII leaks, data exfiltration, and tools poisoning using LLM-based semantic analysis.

How do I configure the Tools Poisoning Engine?

To enable the Tools Poisoning Engine, you need to input your MISTRAL_API_KEY in the settings panel. This allows the system to compare tool specifications against actual usage and detect potential tool misuse.

Compare MCP-Dandan with