From 8119522d6a01fc0ee4f13c9adec9f5d4343c1832 Mon Sep 17 00:00:00 2001
From: armorer-labs <armorer-labs@users.noreply.github.com>
Date: Tue, 19 May 2026 14:36:32 +0800
Subject: [PATCH] Document Armorer Guard MCP proxy

---
 README.md | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/README.md b/README.md
index 7550c36..7d73cc2 100644
--- a/README.md
+++ b/README.md
@@ -143,6 +143,33 @@ Replace the following values:
 }
 ```
 
+#### Optional local guardrail
+
+You can also wrap the same stdio command with [Armorer Guard](https://github.com/ArmorerLabs/Armorer-Guard) to inspect tool-call arguments before they reach the Docker Hub MCP server:
+
+```json
+{
+    "mcpServers": {
+        "docker-hub": {
+            "command": "armorer-guard",
+            "args": [
+                "mcp-proxy",
+                "--",
+                "node",
+                "/FULL/PATH/TO/YOUR/docker-hub-mcp-server/dist/index.js",
+                "--transport=stdio",
+                "--username=YOUR_DOCKER_HUB_USERNAME"
+            ],
+            "env": {
+                "HUB_PAT_TOKEN": "YOUR_DOCKER_HUB_PERSONAL_ACCESS_TOKEN"
+            }
+        }
+    }
+}
+```
+
+The proxy runs locally and checks for prompt injection, credential leakage, exfiltration risk, and dangerous actions before forwarding safe calls.
+
 2. Save the configuration file and completely restart Claude Desktop for the changes to take effect.
 
 ## Usage with VS Code