# evolveguard [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/RudrenduPaul/evolveguard  
**GitHub Stars:** 1  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/evolveguard

## Description
Wraps the evolveguard CLI as a single generic MCP tool for agent-skill file safety checks.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "evolveguard": {
    "command": "uvx",
    "args": ["evolveguard-cli"]
  }
}
```

## Documentation

## What the evolveguard MCP server does

The evolveguard MCP server is intended to let an AI coding agent request safety checks for Claude Agent Skills and Claude Code `MEMORY.md` files. Its underlying CLI records a baseline from a skill file and labeled fixtures, then checks an edited version for behavioral drift.

The analysis is static. It reads YAML frontmatter fields such as declared tools, network access, filesystem permissions, scope, and hooks. It also scans the skill body and hook scripts for evidence of network activity or filesystem writes. The resulting capability surface combines declared and inferred behavior without running the skill, invoking `eval`, starting subprocesses, or executing hook scripts.

## How it works

A typical workflow has two stages. First, `record` analyzes a skill and an optional fixtures JSON file, writing `.evolveguard-baseline.json`. After the file changes, `check` compares the edited file with that baseline and writes a report. Drift normally produces a nonzero exit status, which allows a pre-commit hook or CI job to block the change.

Fixtures can identify prompts and expected tool-call shapes. When `expectedToolCalls` is present, the check evaluates the capabilities relevant to that fixture. It also compares the complete capability surface separately, so a new or widened capability can be reported even when no fixture explicitly covers it. JSON output includes a stable, `schemaVersion`-tagged structure for programmatic consumers.

## Tools and capabilities

The evolveguard MCP server corresponds to three CLI operations documented by the project:

- `record` creates a golden-transcript baseline for a skill and its fixtures.
- `check` re-analyzes the current file and reports fixture-level and surface-level drift.
- `report` prints an existing `evolveguard-report.json` file.

Both the npm TypeScript package and the PyPI Python package implement the same frontmatter format and produce compatible baseline and report JSON. Hook paths are checked against the skill directory, including a symlink-escape validation after lexical containment checks. The CLI supports `--json` for all three operations.

## Setup and configuration

The repository documents installation through either `npm install -g evolveguard-cli` or `pip install evolveguard-cli`. Node.js 20.12 or newer is indicated for the Node distribution. A fixtures file is a JSON array containing an `id`, a prompt, and optional `expectedToolCalls`; `scopeMatches` can narrow a filesystem expectation to a glob such as `./workspace/**`.

The supplied material does not document MCP transport configuration, a server command, an MCP manifest, or environment variables. It identifies the `mcp` CLI subcommand as coming soon, so developers should verify the repository's current implementation before depending on MCP-specific setup.

## Limitations and notes

The evolveguard MCP server does not replay a live LLM conversation or predict how an agent will respond to a prompt. It detects changes in what a skill declares or shows itself capable of doing. The labeled benchmark described in the README contains two non-breaking and three breaking examples, so its reported false-positive result applies only to that small corpus. The tool runs locally and does not require hosted infrastructure.

_Full upstream README: https://allmcps.com/mcp/evolveguard/readme_