# MCP Dandan

> MCP Security Solution for Agentic AI — real-time proxying, behavior analysis, and malicious tool detection

- **Type:** MCP server
- **Install:** `agentstack add mcp-82ch-mcp-dandan`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [82ch](https://agentstack.voostack.com/s/82ch)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [82ch](https://github.com/82ch)
- **Source:** https://github.com/82ch/MCP-Dandan
- **Website:** https://mcp-dandan.netlify.app/

## Install

```sh
agentstack add mcp-82ch-mcp-dandan
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# MCP-Dandan - MCP Security Framework

  
  
  

  

MCP-Dandan

## Overview

MCP-Dandan is an integrated monitoring service that observes MCP (Model Context Protocol) communications and detects security threats in real time. It features a modern desktop UI built with Electron for easy monitoring and management.

Currently, MCP-Dandan is listed in **well-known MCP-related open-source collections** and can be found in the following repositories:
- [Awesome MCP Servers – Security](https://github.com/punkpeye/awesome-mcp-servers?tab=readme-ov-file#security)
- [Awesome MCP Security – Tools & Code](https://github.com/Puliczek/awesome-mcp-security?tab=readme-ov-file#%E2%80%8D-tools-and-code)

https://github.com/user-attachments/assets/928686ab-a5aa-4486-8d8e-d4a9592adc3e

## Features

- **Real-time MCP Traffic Monitoring**: Intercepts and analyzes MCP communications
- **Multi-Engine Threat Detection**:
  - Command Injection Detection
  - File System Exposure Detection
  - PII Leak Detection(custom rules supported)
  - Data Exfiltration Detection
  - Tools Poisoning Detection (LLM-based)
- **Desktop UI**: Electron-based application with interactive dashboard
- **Interactive Tutorial**: Built-in tutorial system for new users
- **Blocking Capabilities**: Real-time threat blocking with user control
- **Cross-Platform**: Supports Windows, macOS, and Linux

## Quick Start
### Installation

```bash
# Clone the repository
git clone https://github.com/82ch/MCP-Dandan.git
cd MCP-Dandan

# Install all dependencies (Python + Node.js)
npm run install-all
```

### Running the Application

```bash
# Start both server and desktop UI
npm run dev
```

The server will start on `http://127.0.0.1:8282` and the Electron desktop app will launch automatically.

## Project Structure

## Detection Engines

### 1. Command Injection Engine
Identifies potential command injection patterns in tool calls.

### 2. File System Exposure Engine
Monitors unauthorized file system access attempts.

### 3. PII Leak Engine (custom rules supported)
Detects potential PII leakage with built-in rules and optional user-defined customization.

### 4. Data Exfiltration Engine
Identifies suspicious data transfer patterns.

### 5. Tools Poisoning Engine (LLM-based)
Uses semantic analysis to detect misuse of MCP tools:
- Compares tool specifications vs actual usage
- Scores alignment (0-100) with detailed breakdown
- Auto-categorizes severity: none/low/medium/high

### Engine Setting

https://github.com/user-attachments/assets/3d6f2304-0a6b-492e-9f2d-bba76df98b4c

Input your MISTRAL_API_KEY to enable the Tools Poisoning Engine, and configure detection settings as needed.

## Desktop UI Features

- **Real-time Dashboard**: Monitor MCP traffic and threats in real time
- **Interactive Tutorial**: Learn how to use the system with step-by-step guides
- **Blocking Interface**: Review and control threat blocking actions
- **Settings Panel**: Configure detection engines and system behavior
- **Chat Panel**: Interact with the system and view logs

https://github.com/user-attachments/assets/19bcbdfb-c893-468d-a8a6-1c7b70a1c7b7

> ## Full Documentation  
> For detailed explanations and technical documentation, please refer to the  
> **[MCP-Dandan Wiki](https://github.com/82ch/MCP-Dandan/wiki)**.
>
> **Have questions or suggestions?**  
> Please visit the **[Discussions](https://github.com/82ch/MCP-Dandan/discussions)** tab.

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [82ch](https://github.com/82ch)
- **Source:** [82ch/MCP-Dandan](https://github.com/82ch/MCP-Dandan)
- **License:** MIT
- **Homepage:** https://mcp-dandan.netlify.app/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-82ch-mcp-dandan
- Seller: https://agentstack.voostack.com/s/82ch
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.