Diogenes Agent Guardrails & Sandbox MCP Server

by stand-out-of-my-sun Your server? Claim it

answering

Diogenes Agent Guardrails & Sandbox MCP is answering right now. Last checked 4 min ago. It exposes 12 tools. Last commit 4 Nov 2026.

Autonomous agent guardrails, bash sandboxing, MCP rugpull diffing & prompt firewalls.

Uptime history 19 days of history · worst day 38%

19 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

196 ms

Response time

average over 24h

Stars

last commit 4 Nov 2026

What changed 29

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 21 October 2026. No other catalogue keeps this.

26 Oct 2 tool descriptions were rewritten detect_agent_action_loop, verify_agent_command_safety

21 Oct 12 tools appeared audit_mcp_server_manifest, audit_outbound_egress_url, audit_response_factuality and 9 more

21 Oct 9 tools disappeared agent_loop_circuit_breaker, agent_mcp_manifest_auditor, agent_sql_guard and 6 more

21 Oct 3 tool descriptions were rewritten audit_outbound_egress_url, execute_python_sandbox, validate_sql_query_ast

21 Oct 3 tools changed the parameters they ask for audit_outbound_egress_url, execute_python_sandbox, validate_sql_query_ast

What the code does

We read the source, 3 d ago · tools taken from the live server · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Runs an external command index.js:136

        const stdout = childProcess.execSync(cmd, { encoding: "utf-8", timeout: 15000 });

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 4 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add diogenes-agent-guardrails-mcp --transport http https://diogenes-micro-gateway.corinth.workers.dev/mcp/agent-guardrails

Settings → Connectors → Add custom connector, then paste this address

https://diogenes-micro-gateway.corinth.workers.dev/mcp/agent-guardrails

~/.codex/config.toml

[mcp_servers.diogenes-agent-guardrails-mcp]
url = "https://diogenes-micro-gateway.corinth.workers.dev/mcp/agent-guardrails"

.cursor/mcp.json

{
  "mcpServers": {
    "diogenes-agent-guardrails-mcp": {
      "url": "https://diogenes-micro-gateway.corinth.workers.dev/mcp/agent-guardrails"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "diogenes-agent-guardrails-mcp": {
      "type": "http",
      "url": "https://diogenes-micro-gateway.corinth.workers.dev/mcp/agent-guardrails"
    }
  }
}

Available tools 12

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

audit

audit_mcp_server_manifest

Scans an external MCP server's initial tools/list manifest to detect tool-name shadowing (read_file, bash) and hidden prompt-injection directives in descriptions. Use when vetting a newly discovered third-party MCP server before mounting it into an agent session; for comparing a previously pinned MCP baseline against a live mid-session tools/list response, use detect_mcp_schema_rugpull instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'manifest_json' ('audit_profile' defaults to 'strict'), supports '?demo=true' or L402 (25 sats), and returns HTTP 400 if invalid.

audit_outbound_egress_url

Static validation firewall for outbound network destination URIs against cloud metadata IP addresses (169.254.169.254), RFC 1918 private IP blocks, and query-string secret exfiltration before agent dispatch. Use when validating a user-supplied or tool-supplied URI destination before network dispatch; for auditing local shell commands or general prompts, use verify_agent_command_safety instead. Read-only edge call (32 KB, 60 RPM): accepts 'destination_uri' ('egress_policy' defaults to 'block_private_and_metadata'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

audit_response_factuality

Cross-references factual claims, numbers, and citations in a draft agent response against retrieved source passages to flag unsupported hallucinations before delivery. Use when verifying that a generated answer is 100% grounded in source evidence before returning it to the user; for scrubbing inbound tool outputs for prompt-injection and invisible Unicode, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'claim' ('context' defaults to 'standard'), supports '?demo=true' or L402 (25 sats), and returns HTTP 400 if invalid.

detect

detect_agent_action_loop

Analyzes an agent's recent tool-call trace to detect identical retry spins, A/B state oscillation, and runaway token burn. Use when monitoring autonomous agent execution loops to decide whether to continue or trip a token-burn breaker; for inspecting a single command payload for security threats before execution, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'action_trace_json' ('sensitivity' defaults to 'strict_2_repeats'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

detect_mcp_schema_rugpull

Computes structural diffs between a pinned baseline MCP tools/list snapshot and a live server response to catch mid-session description or schema tampering. Use when verifying that a connected MCP server has not mutated its tool definitions mid-session; for performing a first-time static security audit on a single MCP manifest, use audit_mcp_server_manifest instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'baseline_tools_json' ('current_tools_json' defaults to 'standard'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

validate

validate_mcp_sampling_request

Audits inbound MCP sampling/createMessage callbacks from connected servers to block cross-server context snooping (includeContext='allServers') and token quota hijacking. Use when filtering a connected MCP server's request to sample the host LLM; for scrubbing text returned from a standard synchronous tools/call response, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'sampling_request_json' ('max_tokens_ceiling' defaults to '512'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

validate_sql_query_ast

Performs static AST syntax tree parsing on SQL statements to verify strictly read-only SELECT clauses and reject mutations, stacked queries, or comment bypasses. Use when verifying that an agent-authored SQL statement is strictly read-only before running it on a database; for screening non-SQL bash commands or general agent prompts, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'sql_statement' ('dialect' defaults to 'postgres'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

verify

verify_a2a_agent_card

Verifies a remote agent's A2A /.well-known/agent.json discovery card, checking JWS/DID signature binding, endpoint HTTPS enforcement, and capability spoofing. Use when authenticating a peer autonomous agent before delegating subtasks or exchanging payments over A2A; for auditing an MCP tool server's tools/list manifest rather than a peer agent's A2A card, use audit_mcp_server_manifest instead. Read-only edge call (32 KB, 60 RPM): accepts 'agent_card_json' ('trust_policy' defaults to 'require_https_and_did'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

verify_agent_command_safety

Evaluates untrusted agent prompts, bash commands, and tool arguments to block prompt injection, destructive shell commands, and private-key exfiltration. Use when screening a general shell command or user prompt before autonomous agent execution; for statically validating SQL database queries at the AST level, use validate_sql_query_ast instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'payload' ('action_type' defaults to 'bash_command'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

execute

execute_python_sandbox

Audits Python source code for forbidden syscalls (os, subprocess, socket, open, eval) inside an AST-governed WebAssembly sandbox with no host filesystem access. Use when executing LLM-generated Python snippets safely; for checking shell commands without executing code, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'python_script' ('timeout_profile' defaults to 'fast_1s'), supports '?demo=true' or MPP (250 sats), and returns HTTP 400 if invalid.

redact

redact_sensitive_pii

Redacts emails, phone numbers, SSNs, credit cards, API keys, and crypto private keys from text before logging or external transmission. Use when stripping personal data or secret credentials from prompts, logs, or outbound messages; for neutralizing indirect prompt injections and invisible Unicode in inbound tool responses, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'text' ('redaction_style' defaults to 'typed_token'), supports '?demo=true' or L402 (25 sats), and returns HTTP 400 if invalid.

sanitize

sanitize_tool_output_stream

Sanitizes untrusted external tool or web-scrape outputs by stripping invisible Unicode Tag characters (U+E0000), neutralizing Markdown tracking image beacons, and defusing indirect prompt overrides. Use when cleaning raw third-party tool outputs or scraped web text before inserting it into the LLM context window; for redacting personal identifiable information (emails, SSNs, keys) from outbound text, use redact_sensitive_pii instead. Read-only edge call (32 KB, 60 RPM): accepts 'raw_tool_output' (with enum defaults), uses '?demo=true' or L402 (15 sats); HTTP 400 if invalid.

Tools removed

Tools this server used to expose. Anything built against them stopped working on the day they went.

agent_loop_circuit_breaker

removed 21 Oct 2026

agent_mcp_manifest_auditor

removed 21 Oct 2026

agent_sql_guard

removed 21 Oct 2026

code_sandbox

removed 21 Oct 2026

guardrail_verify

removed 21 Oct 2026

mcp_rugpull_diff

removed 21 Oct 2026

mcp_sampling_guard

removed 21 Oct 2026

scrub_pii

removed 21 Oct 2026

tool_output_firewall

removed 21 Oct 2026

Endpoints

URL	Transport	State	Latency	Checked
https://diogenes-micro-gateway.corinth.workers.dev/mcp/agent-guardrails	streamable-http	answering	231 ms	4 min ago

Alternatives to Diogenes Agent Guardrails & Sandbox MCP

same job, measured the same way

DBShield Database Guardrail & Sandboxing MCP Server

by ritualdev-lab

Safety-first Database Guardrail & Sandboxing MCP Server for AI Coding Agents

local only

gethal.ai

by gethal

Public MCP for gethal.ai — autonomous AI sales agent. Pricing, features, book a demo.

9 tools answering

Gsep MCP

by gsepcore

AI agent security via MCP: C3 firewall, C4 immune system, C5 action guard, self-evolving prompts.

87 installs/wk local only

Suprawall MCP

by wiserautomation

SupraWall security gateway for AI agents. Provides deterministic guardrails for MCP agents.

29 installs/wk local only

grad-agent

by i-ninte

Autonomous MCP agent for grad school applications: prof discovery, cold emails, SOP, tracking.

140 installs/wk local only

AI Firewall MCP

by akhilucky

Multi-agent LLM security layer detecting prompt injection and jailbreaks.

167 installs/wk local only

Mails.ai — Agent Email

by mails

A real inbox for AI agents: send, receive and thread email, behind a prompt-injection firewall.

380 installs/wk answering

Mails.ai — Agent Email

by rolloutsai

A real inbox for AI agents: send, receive and thread email, behind a prompt-injection firewall.

local only

Diogenes Agent Guardrails & Sandbox MCP — questions

Answers built from our own checks of this server.

What can Diogenes Agent Guardrails & Sandbox MCP do?

It exposes 12 tools, read directly from the server on our last check. Among them: audit_mcp_server_manifest, audit_outbound_egress_url, audit_response_factuality, detect_agent_action_loop, detect_mcp_schema_rugpull, execute_python_sandbox and 6 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

What is Diogenes Agent Guardrails & Sandbox MCP mostly used for?

Its tools cluster around audit, validate and verify. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.

Is Diogenes Agent Guardrails & Sandbox MCP working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 196 ms. The bar chart above shows every period we have measured.

Did Diogenes Agent Guardrails & Sandbox MCP ever remove tools?

Yes. agent_loop_circuit_breaker, agent_mcp_manifest_auditor, agent_sql_guard, code_sandbox and 5 more are no longer exposed — we recorded the date each one disappeared. A tool vanishing usually means a breaking change for anything that depended on it.

How do I connect Diogenes Agent Guardrails & Sandbox MCP?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Diogenes Agent Guardrails & Sandbox MCP need an API key?

No. Diogenes Agent Guardrails & Sandbox MCP completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 12 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Diogenes Agent Guardrails & Sandbox MCP?

It answers our handshake in 196 ms on average, which is faster than 68% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.

Is Diogenes Agent Guardrails & Sandbox MCP open source?

The code is open source: it is published under the MIT licence, written in JavaScript and 2 stars on GitHub. The licence covers the code in the repository, not the hosted service at diogenes-micro-gateway.corinth.workers.dev, which runs on its operator's own terms.