MCP-Dandan

MCP-Dandan is an integrated monitoring service that observes MCP (Model Context Protocol) communications and detects security threats in real time. It features a modern desktop UI built with Electron for easy monitoring and management.

Currently, MCP-Dandan is listed in well-known MCP-related open-source collections and can be found in the following repositories:

• Awesome MCP Servers – Security
• Awesome MCP Security – Tools & Code

• Real-time MCP Traffic Monitoring: Intercepts and analyzes MCP communications
• Multi-Engine Threat Detection:
  • Command Injection Detection
  • File System Exposure Detection
  • PII Leak Detection(custom rules supported)
  • Data Exfiltration Detection
  • Tools Poisoning Detection (LLM-based)
• Desktop UI: Electron-based application with interactive dashboard
• Interactive Tutorial: Built-in tutorial system for new users
• Blocking Capabilities: Real-time threat blocking with user control
• Cross-Platform: Supports Windows, macOS, and Linux

# Clone the repository
git clone https://github.com/82ch/MCP-Dandan.git
cd MCP-Dandan

# Install all dependencies (Python + Node.js)
npm run install-all

# Start both server and desktop UI
npm run dev

The server will start on http://127.0.0.1:8282 and the Electron desktop app will launch automatically.

Identifies potential command injection patterns in tool calls.

Monitors unauthorized file system access attempts.

Detects potential PII leakage with built-in rules and optional user-defined customization.

Identifies suspicious data transfer patterns.

Uses semantic analysis to detect misuse of MCP tools:

• Compares tool specifications vs actual usage
• Scores alignment (0-100) with detailed breakdown
• Auto-categorizes severity: none/low/medium/high

Input your MISTRAL_API_KEY to enable the Tools Poisoning Engine, and configure detection settings as needed.

• Real-time Dashboard: Monitor MCP traffic and threats in real time
• Interactive Tutorial: Learn how to use the system with step-by-step guides
• Blocking Interface: Review and control threat blocking actions
• Settings Panel: Configure detection engines and system behavior
• Chat Panel: Interact with the system and view logs

Full Documentation

For detailed explanations and technical documentation, please refer to the
MCP-Dandan Wiki.

Have questions or suggestions?
Please visit the Discussions tab.