MCP Stdio Shellguard

Defense-in-depth bundle for MCP stdio servers

Drop-in guardExec / guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the OX Security 200k-server stdio-RCE class (CVE-2025-69256). Unicode-bypass-hardened, allowlist-based, replay-window protected. MIT, TypeScript, Node 20+.