AgentGuard

AgentGuard is a process between the AI agent and the MCP server. The agent's client configuration points at AgentGuard instead of the server. AgentGuard launches the real server, and every message between the two then passes through it. It works on MCP's stdio transport, newline-delimited JSON-RPC, so neither the agent nor the server changes any code. Each tools/call and resources/read request is checked before it is forwarded. The results of those calls, and of prompts/get, are checked before they are returned.

The first command installs from PyPI. The second starts the MCP server through agentguard instead of directly. The third checks the audit log. The default policy ships inside the package. To change the rules, export a copy with agentguard default-policy and pass it with --config. The only change on the client side is the launch command. The server is not changed.

pip install agentguard-mcp
agentguard run -- python3 your_mcp_server.py
agentguard verify-audit agentguard_audit.log

The repository's demo/run_demo.sh runs twelve steps under the default policy against a server with no restrictions of its own, first without the proxy and then with it. A read of ~/.ssh/id_rsa is denied and logged. The same read through a tool whose argument is not called path is denied as well. A file that contains an AWS key is returned with the key masked. A poisoned web page is fetched, because the URL is legitimate, and its content is blocked whole as injection. agentguard report lists what the session touched. An audit entry is edited by hand, and the next verify reports the changed line. The recording was made with 0.2.0 and runs about 40 seconds.

• It does not sandbox the MCP server process. What the server does at the operating-system level is invisible to a protocol-level proxy.
• It does not catch every injection phrasing. The rules are public in the policy YAML, so anyone who has read them can write around them. Normalization before matching handles zero-width characters, lookalike and fullwidth characters and one layer of base64, so nested encodings and text inside images are missed. An LLM classification layer is planned for this gap and is not built yet.
• The audit log detects tampering. It does not prevent it. Without a head stored elsewhere, deleted trailing entries or a fully rewritten log cannot be detected. With one, they can be detected, not prevented.
• An argument that fits no category is allowed by default and logged as unclassified. It is denied only with unclassified_arguments: deny.
• There is no timeout on a single tool call, and no rate limit.

The full reasoning is in THREAT_MODEL.md.

Tools such as garak and promptfoo red-team a model before deployment. They do not see what a running agent receives. AgentGuard is on the runtime traffic path and enforces policy on every call. The two kinds of tool are complementary, not the same category.

The same category is MCP runtime gateways: mcp-firewall, Lasso's MCP Gateway, Microsoft's MCP Gateway and several smaller interceptors. They reached roughly the same shape over the same period. The difference is size. AgentGuard has one runtime dependency, about 3,900 lines of core code in 13 modules, no dashboard and no SaaS component, and an audit log whose tamper evidence is documented and can be checked independently. It has fewer features than those tools. In return, the code can be read and reviewed in full. The survey in the repository compares them item by item, including where the more mature options are ahead.

• An LLM classification layer after the rules, as a second judgment on output the regexes did not flag. Version 0.2 left it out on purpose, so that the existing guarantees hold first. The rules stay, because their results are deterministic and auditable.
• Real traffic before more rules. The false-positive rate can only be stated as none observed, because the detector has processed too little real content.
• Automatic storage of the audit chain's anchors off the host. Today agentguard anchor prints the head, and the user decides where to keep it.
• Human approval on Windows, and Streamable HTTP transport. Only stdio is supported today.
• A decision on direction, made on that evidence: extend toward the broader gateways, or keep the current size.