Protecting the builders

What it is

NetworkGuardian is a personal / builder-focused security monitor written in Rust. It is not a cloud EDR and not a full Snort replacement. It is a local dashboard + agent that answers: right now, who on this machine is talking outbound, and does that look expected?

• Default command: local web dashboard + connection sampler on http://127.0.0.1:8787/
• Process → destination map (active TCP), destination categories (llm / registry / cloud / lan / …)
• YAML policy rules, desktop alerts for high severity, SQLite history
• MCP stdio server so coding agents can query posture without leaving the IDE
• Optional Npcap packet path and optional Suricata EVE JSON ingest (hybrid IDS)

Features (current)

Architecture

Browser (localhost)
        │
        ▼
  ng-api  axum · 127.0.0.1 only · SSE /api/events
        │
        ▼
  SQLite  connections · destinations · alerts
        ▲
        │
  sampler  process↔socket + YAML rules + AI-client labels
        ▲
        │
  optional  Npcap packets · Suricata eve.json

Privacy defaults: loopback bind only, local SQLite, no telemetry. Future clients (MCP, mobile, Store UI) reuse the same local API.

Get started

git clone https://github.com/AktI-Tech/network-guardian.git
cd network-guardian
cargo build --release
cargo run --release
# → open http://127.0.0.1:8787/

cargo run --release -- connections   # one-shot process → dest
cargo run --release -- mcp           # MCP stdio for IDE agents
cargo run --release -- serve --eve path/to/eve.json  # Suricata hybrid

Requirements: Rust stable, Windows 10/11 (primary) or Linux. Optional packet capture: Npcap + Admin, build with --features packet-capture.

MCP for builders

Point your IDE / agent at the binary:

{
  "mcpServers": {
    "network-guardian": {
      "command": "network_guardian",
      "args": ["mcp"]
    }
  }
}

Read-only tools: security_summary, list_active_connections, list_alerts, destination_category.

Live changelog

Pulled from GitHub commits and releases on this page load — stays current as the repo moves.

Roadmap

1. Done — Local dashboard, process→destination, rules, MCP, Suricata EVE hook (v0.3)
2. Next — Deeper WSL/Docker visibility, richer YAML rules, tray / autostart
3. Later — Mobile companion (Google Play), Microsoft new-device / ARM64 clients, Store UI companion