# agent-runtime-guard [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/DSHCorrectover/agent-runtime-guard  
**GitHub Stars:** 1  
**npm Downloads (last month):** 398  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/agent-runtime-guard

## Description
Agent 运行时全栈拦截: allow/deny tool calls, Ed25519 receipts, blocks RCE, theft, SSRF, injection. stdio.

## Tools
Capabilities this server exposes over MCP:

- **verify_tool_call** — 7 维运行时验证 + 语义攻击链分析 + 数值溢出检测，**默认拦截
- **issue_evidence** — 出具防篡改证据（`content_hash` + `evidence_hash`，可链），放行和拦截都产生
- **audit_mcp_config** — 审计 MCP 配置的安全风险
- **verify_intent_binding** — 校验实际参数与声明意图是否一致——零容忍、零 LLM，抓跨模型参数漂移（规划写 `amount:100`，执行写成 `amount:10000` → 拦截）
- **verify_receipt** — 离线校验 Ed25519 收据签名、检测篡改，可固定可信签名者

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "agent-runtime-guard": {
    "command": "npx",
    "args": ["-y","agent-runtime-guard"]
  }
}
```

## Documentation

## What agent-runtime-guard MCP server does

The agent-runtime-guard MCP server evaluates agent actions before they are passed to a dangerous operation. Its coverage includes tool calls, shell commands, network requests, and returned output. Decisions default to deny when a risk is detected, or when validation fails or times out.

The guard looks for command injection, path traversal, SSRF targets such as cloud metadata addresses, credential exposure, encoded or obfuscated escalation signals, numeric hazards, prompt injection in tool results, and attack chains that span multiple tools. It can also identify a sequence such as reading a sensitive file and then sending its contents over the network.

The server is intended for runtime enforcement rather than retrospective audit alone. It can run as an MCP server for supported clients, and the project also documents a transparent stdio proxy for placing an additional boundary around another MCP server.

## How it works

`verify_tool_call` performs seven-dimensional runtime validation, semantic attack-chain analysis, and numeric overflow checks. The documented policy is fail-closed: suspicious calls are blocked instead of forwarded.

`verify_intent_binding` compares the parameters actually being executed with the declared intent. It uses a zero-tolerance, non-LLM check to detect parameter drift between planning and execution, such as changing an amount from 100 to 10,000.

Each allow or deny decision can produce an Ed25519-signed JSON receipt. Receipts include a content hash, an evidence hash, and an optional parent evidence hash that links decisions into a chain. Third parties can validate the result offline without relying on the operator.

## Setup and configuration

Run the server with Node.js 18 or later:

```bash
npx -y agent-runtime-guard
```

The package uses Node.js standard-library functionality and does not require an API key, account, or environment variable for its initial startup. A client can register it as a stdio MCP server with a configuration equivalent to:

```json
{
  "mcpServers": {
    "agent-runtime-guard": {
      "command": "npx",
      "args": ["-y", "agent-runtime-guard"]
    }
  }
}
```

The agent-runtime-guard MCP server generates an Ed25519 signing key on first use. Set `CCS_KEY_DIR` to control the key directory, or provide `CCS_PRIVATE_KEY` and `CCS_PUBLIC_KEY` when a fixed key pair is needed. The README names Claude Code, Cursor, Cline, and Windsurf as MCP client options. It also documents a DeepSeek Harness plugin mode and use with the separate `agent-runtime-proxy` package.

## Tools and capabilities

- `verify_tool_call`: Validates a proposed call, including semantic attack chains and numeric overflow conditions.
- `issue_evidence`: Creates chained, tamper-evident evidence for both allowed and blocked decisions.
- `audit_mcp_config`: Reviews an MCP configuration for security risks.
- `verify_intent_binding`: Detects mismatches between declared intent and executed parameters without using an LLM.
- `verify_receipt`: Checks Ed25519 receipt signatures offline, detects tampering, and can restrict validation to trusted signers.

## Limitations and notes

The agent-runtime-guard MCP server does not replace authentication, payment networks, or a general policy engine. Its protocol background includes an IETF Internet-Draft, but the README explicitly states that the draft is not an RFC and does not represent IETF endorsement.

The documented protection is execution-time interception, not a guarantee that every possible attack or unsafe operation will be identified. The project recommends local, default-deny decisions rather than depending on a host model or remote classifier. It also notes that child agents should not be able to replace runtime permission state, and that subprocess environments should be minimized to avoid exposing credentials unnecessarily.

License: Elastic License 2.0 (ELv2).

_Full upstream README: https://allmcps.com/mcp/agent-runtime-guard/readme_