Log inSubmit server
Agentward logo

Agentward

by agentward-ai

Enforces YAML permissions on agent tool calls, inspects sensitive data and tool chains, and records audit trails.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Agentward

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "agentward-ai-agentward": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

The agentward-ai/agentward MCP server places a policy-enforcing proxy between AI agents and their tools. It evaluates tool calls against least-privilege YAML rules, classifies sensitive data such as PII and PHI, detects dangerous tool chains, and produces compliance audit trails. It supports stdio and HTTP proxy modes, with policies enforced in code outside the model context. Reach for it when agents need filesystem or other tool access with runtime permission checks and auditability.

Use cases

  • Enforce allowed file paths for agent filesystem operations
  • Require approval for sensitive or destructive tool calls
  • Scan MCP configurations and skills for security risks
  • Detect dangerous combinations of agent tools
  • Generate audit records for agent activity

Key features

  • YAML policy enforcement
  • PII and PHI classification
  • Dangerous tool-chain detection
  • Stdio and HTTP proxy modes
  • Filesystem tools limited to allowed directories
  • JSON Lines and RFC 5424 audit output

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

5/5 checks healthy over the last 78d

Supply-chain signal

2 high-severity advisories on record for this package. Most advisories affect transitive dependencies and may not be exploitable in this server's actual usage — this is a directional signal, not a security audit.

Critical 0High 2Medium 0Low 0

Scanned 4d ago via OSV.dev · @modelcontextprotocol/server-filesystem (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars19Stargazers on the source repository.
npm downloads2MPackage downloads in the last 30 days.
Last commit3mo agoMost recent push to the default branch.
Directory activity7 viewsConfig copies, upvotes, and views on AllMCPs.

How Agentward works

What agentward-ai/agentward MCP server does

The agentward-ai/agentward MCP server acts as a security control point for AI agent tool use. It sits between an agent and connected tools, then evaluates each tool call against declarative YAML policy rules. The stated goal is least-privilege enforcement at runtime rather than relying on instructions placed in the model context.

The project is categorized under 🔒 Security and is intended for environments where agents can access files, APIs, email, calendars, databases, shells, or other capabilities. It can classify sensitive information, including PII and PHI, identify dangerous combinations of tools or actions, and create compliance audit trails. The material also describes scanning and policy-generation workflows for existing MCP configurations and Python tool definitions.

How it works

AgentWard operates as a proxy between the client-side agent and its tools. Every tools/call request can be checked against a YAML policy before the underlying operation runs. Rules can allow, block, or require approval for actions, and can constrain arguments such as file paths. Enforcement occurs in application code outside the LLM context, so changing the prompt does not change the policy.

The project describes a lifecycle of scanning, configuring, enforcing, verifying, and monitoring. Scanning can discover MCP configurations for supported agent environments, inspect Python tool definitions, classify risks, and detect patterns such as interpreter-plus-stdin chains, write-then-reconfigure persistence chains, and URL parameters without allowlists. Monitoring can produce JSON Lines audit output and RFC 5424 syslog output for SIEM use.

The proxy supports both stdio and HTTP modes. The repository also describes checks for supply-chain risks in skill directories, including unsafe deserialization, YAML loading patterns, executable installation hooks, dependency names, and Python .pth files.

Setup and configuration

The documented starting point is Python 3.11 or newer, followed by installation from PyPI:

Terminal
pip install agentward
agentward init

The init command scans available tools, presents a risk summary, generates a recommended policy, and wires the proxy into the environment. Individual stages can also be run separately. agentward scan accepts a project, skill directory, MCP configuration, or other path. agentward configure generates an agentward.yaml file with security-aware defaults based on scan results.

Policies use YAML and can define a default action, per-skill and per-tool actions, approval requirements, and argument constraints. The repository shows path restrictions such as required prefixes, prohibited path traversal, and blocklisted sensitive paths. The exact policy needed depends on the tools and agent environment being protected.

Tools and capabilities

The listed MCP tools provide filesystem operations within allowed directories:

  • Read text, media, or multiple files; read_file is deprecated in favor of read_text_file.
  • Create, overwrite, edit, move, and rename files or directories.
  • List directories, include file sizes, or return a recursive directory tree.
  • Search for files and directories with glob-style patterns.
  • Retrieve file or directory metadata.
  • List the directories available to the server.

The agentward-ai/agentward MCP server restricts these operations to configured allowed directories. Text reads support head and tail limits, while media reads return base64 content with a MIME type.

Limitations and notes

It also does not identify every supported MCP client beyond the environments named in the repository, which include Claude Desktop, Cursor, Windsurf, and VS Code. The read_file operation remains listed but is explicitly deprecated.

The project is source-available under the Business Source License 1.1. Review the repository license and policy behavior before deploying it in a production environment.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Agentward

Use Python 3.11 or newer, run `pip install agentward`, and then run `agentward init`.

It proxies tool calls and evaluates each `tools/call` request against declarative YAML policies in code, outside the LLM context.

The repository lists Claude Desktop with configured MCP servers among the supported environments.

Yes. Its listed filesystem tools operate only within allowed directories, and YAML policies can add path constraints.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAgentward AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/agentward-ai-agentward?style=directory)](https://allmcps.com/mcp/agentward-ai-agentward)
HTML Embed
<a href="https://allmcps.com/mcp/agentward-ai-agentward"><img src="https://allmcps.com/api/badge/agentward-ai-agentward?style=directory" alt="Agentward on AllMCPs" /></a>