Agent Runtime Guard

What agent-runtime-guard MCP server does

The agent-runtime-guard MCP server evaluates agent actions before they are passed to a dangerous operation. Its coverage includes tool calls, shell commands, network requests, and returned output. Decisions default to deny when a risk is detected, or when validation fails or times out.

The guard looks for command injection, path traversal, SSRF targets such as cloud metadata addresses, credential exposure, encoded or obfuscated escalation signals, numeric hazards, prompt injection in tool results, and attack chains that span multiple tools. It can also identify a sequence such as reading a sensitive file and then sending its contents over the network.

The server is intended for runtime enforcement rather than retrospective audit alone. It can run as an MCP server for supported clients, and the project also documents a transparent stdio proxy for placing an additional boundary around another MCP server.

How it works

verify_tool_call performs seven-dimensional runtime validation, semantic attack-chain analysis, and numeric overflow checks. The documented policy is fail-closed: suspicious calls are blocked instead of forwarded.

verify_intent_binding compares the parameters actually being executed with the declared intent. It uses a zero-tolerance, non-LLM check to detect parameter drift between planning and execution, such as changing an amount from 100 to 10,000.

Each allow or deny decision can produce an Ed25519-signed JSON receipt. Receipts include a content hash, an evidence hash, and an optional parent evidence hash that links decisions into a chain. Third parties can validate the result offline without relying on the operator.

Setup and configuration

Run the server with Node.js 18 or later:

npx -y agent-runtime-guard

The package uses Node.js standard-library functionality and does not require an API key, account, or environment variable for its initial startup. A client can register it as a stdio MCP server with a configuration equivalent to:

{
  "mcpServers": {
    "agent-runtime-guard": {
      "command": "npx",
      "args": ["-y", "agent-runtime-guard"]
    }
  }
}

The agent-runtime-guard MCP server generates an Ed25519 signing key on first use. Set CCS_KEY_DIR to control the key directory, or provide CCS_PRIVATE_KEY and CCS_PUBLIC_KEY when a fixed key pair is needed. The README names Claude Code, Cursor, Cline, and Windsurf as MCP client options. It also documents a DeepSeek Harness plugin mode and use with the separate agent-runtime-proxy package.

Tools and capabilities

• verify_tool_call: Validates a proposed call, including semantic attack chains and numeric overflow conditions.
• issue_evidence: Creates chained, tamper-evident evidence for both allowed and blocked decisions.
• audit_mcp_config: Reviews an MCP configuration for security risks.
• verify_intent_binding: Detects mismatches between declared intent and executed parameters without using an LLM.
• verify_receipt: Checks Ed25519 receipt signatures offline, detects tampering, and can restrict validation to trusted signers.

Limitations and notes

The agent-runtime-guard MCP server does not replace authentication, payment networks, or a general policy engine. Its protocol background includes an IETF Internet-Draft, but the README explicitly states that the draft is not an RFC and does not represent IETF endorsement.

The documented protection is execution-time interception, not a guarantee that every possible attack or unsafe operation will be identified. The project recommends local, default-deny decisions rather than depending on a host model or remote classifier. It also notes that child agents should not be able to replace runtime permission state, and that subprocess environments should be minimized to avoid exposing credentials unnecessarily.

License: Elastic License 2.0 (ELv2).