Agentguard

What agentguard MCP server does

The agentguard MCP server adds a control layer around AI agent tool execution. Its tools can inspect a proposed call, calculate a 0–100 risk score, detect secrets and unsafe payloads, determine whether human approval is needed, and return an allow, deny, approval, or flagged outcome. The default policy set covers payments, high-risk calls, exposed secrets, rate limits, low-risk calls, prompt injection, and repeated calls.

The system also supports controls for payment policies, spend limits, replay detection, role scopes, sessions, tenants, and entity threat intelligence. Built-in tenant profiles include default, fintech_eu, defi_protocol, and enterprise_read. Roles include admin, compliance_officer, trader, auditor, developer, and readonly, each with predefined scopes.

How it works

A typical workflow starts with policy_preflight before the target tool executes. That check evaluates policies, calculates risk, detects threats, and automatically records the request. If approval is required, approval_required can register a pending request and provide a tracking URL. The agent then executes the approved call and uses audit_log_write to record its outcome.

tool_risk_score can be used independently for a fresh assessment. Risk indicators include API keys, passwords, prompt injection, and high-value amounts. Other checks scan for payment-policy violations, 19 secret patterns, 18 payload-safety patterns, replayed requests, anomalous tool sequences, scope violations, and threats involving detected Ethereum addresses, IPs, or domains.

The audit layer uses SQLite in WAL mode. audit_log_query supports filters for agent, tool, decision, and time range, with pagination and signed entries for tamper verification. decision_explain produces a human-readable explanation from a stored request ID or a new tool-and-arguments analysis. rate_limit_check reports usage against 200 calls per minute, 5,000 per hour, and 50,000 per day.

Setup and configuration

The agentguard MCP server can be connected through either of the documented remote endpoints:

• https://feedoracle.io/guard/mcp/
• https://tooloracle.io/guard/mcp/

Use npx -y mcp-remote with one endpoint. A client configuration names the server agentguard, sets npx as the command, and passes -y, mcp-remote, and the endpoint URL as arguments.

Tools and capabilities

The documented capabilities include:

• Preflight policy evaluation and decision explanations
• Risk scoring, secret scanning, payload safety checks, and threat intelligence
• Human approval registration and payment or spend-policy checks
• Signed audit writes and filtered audit queries
• Rate limits, replay protection, anomaly detection, scopes, sessions, and tenant policies

Limitations and notes

It does not define custom policy configuration, authentication requirements, endpoint availability guarantees, or client-specific setup. SQLite WAL is identified as the persistence backend, but no backup, retention, or deployment guidance is provided.