bugwarden

bugwarden exposes Bugzilla to MCP (Model Context Protocol) clients through a
guard policy that the client can neither read nor change. The policy is a TOML
file read once at startup and decides, per bug, which of thirteen capabilities
a client is granted, so an operator can expose a Bugzilla instance to an LLM
client while keeping undisclosed security bugs, private comments and write
access out of reach.
Denials are uniform: a bug hidden by policy is indistinguishable from one that
does not exist, and search results filtered by policy are dropped silently.
What the client may not see, the operator can: an optional append-only audit
stream records every tool call together with the guard's verdict.

          

---

License: (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR LGPL-2.1-or-later OR MIT) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND (Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT) AND (MIT OR Unlicense) AND Apache-2.0 AND BSD-3-Clause AND CDLA-Permissive-2.0 AND ISC AND MIT AND Unicode-3.0
URL: https://github.com/plusky/bugwarden