Agentguard MCP Server

io.tooloracle/agentguard

not responding

Agentguard is listed as active in the registry but did not answer our last check. It exposes 24 tools. Last commit 8 Apr 2026.

AgentGuard — 20-tool AI safety MCP: policy preflight, risk scoring, audit logging, rate limits.

Uptime history 40 hours of history · worst hour 0%

40 hours agonow

0.0%

Uptime 24h

0 of 91 checks

Tools

read from the server

7293 ms

Response time

average over 24h

Stars

last commit 8 Apr 2026

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 9 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add agentguard --transport http https://feedoracle.io/guard-oracle/mcp/

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "agentguard": {
      "url": "https://feedoracle.io/guard-oracle/mcp/"
    }
  }
}

~/.codex/config.toml

[mcp_servers.agentguard]
url = "https://feedoracle.io/guard-oracle/mcp/"

.cursor/mcp.json

{
  "mcpServers": {
    "agentguard": {
      "url": "https://feedoracle.io/guard-oracle/mcp/"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "agentguard": {
      "url": "https://feedoracle.io/guard-oracle/mcp/"
    }
  }
}

Available tools 24

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

approval

approval_list

List approval requests. Filter by status (pending/approved/denied/all), agent_id, or tool_name. Shows summary stats.

approval_required

Check if a tool call requires human approval before execution. Returns requires_approval=true/false with matched policy list. Set register_pending=true to create a trackable approval request with an approval_url for human review.

approval_resolve

Resolve a pending approval request. Approve or deny a tool call that was flagged for human review. Updates agent state and creates audit trail. Requires authentication.

audit

audit_log_query

Query the persistent audit trail. Filter by agent, tool, decision, time range. Returns signed entries with tamper-detection. Use for compliance reporting, anomaly detection, or agent behaviour analysis.

audit_log_write

Write a tool call result to the persistent, signed audit log. Call this AFTER tool execution with the outcome. Each entry is cryptographically signed for tamper-evidence. Essential for compliance, DORA, MiCA audit trail requirements.

policy

policy_preflight

Pre-flight security check before any tool call. Evaluates all policies, computes risk score, checks rate limits, and returns allow/deny/require_approval decision. Call this BEFORE executing any agent tool. Writes to audit log automatically.

policy_register

View the central policy registry. Query tiers (T1-T4), tool classifications, escalation rules. Actions: summary (default), lookup (by tool_name), tiers, rules, tools (by tier_id).

tool

tool_manifest_verify

Supply-chain verification for MCP tools. Checks publisher identity against allowlist, scans tool descriptions for prompt injection, validates server domain and signing capability. Verdict: trusted|caution|block.

tool_risk_score

Compute 0-100 risk score for any tool + input combination. 0=minimal risk (read-only), 100=critical (payment/irreversible). Detects secrets, injection attempts, high-value amounts. Use before deciding whether to proceed with a tool call.

cross

cross_tool_anomaly_check

Detect anomalous tool usage patterns across an agent recent history. Checks risky tool combinations (AML-then-payment, wallet-recon-then-transfer), high call frequency, repeated denials, broad reconnaissance, elevated risk scores.

decision

decision_explain

Get a human-readable explanation of why a tool call was allowed or denied. Pass request_id from a previous policy_preflight for stored explanation, or provide tool_name + tool_args for fresh analysis. Explains matched policies, risk score breakdown, and recommendation.

emergency

emergency_kill

Emergency kill-switch. Immediately terminates agent session(s), revokes pending approvals, blocks rate limits, and audit-logs the emergency. Use for: compromised agents, runaway automation, suspicious behavior. kill_type: full|session_only|soft.

guard

guard_metrics

AgentGuard operational metrics. Returns decision stats, top agents/tools, risk distribution, daily activity, approval stats, and tier distribution.

output

output_safety_scan

Post-execution output scanner. Checks tool output for PII leaks (email, phone, SSN, IBAN), secret exposure, data exfiltration patterns (outbound URLs, base64), and tool poisoning (injected instructions). Verdict: clean|warn|flag|block.

payload

payload_safety_check

Comprehensive safety scan for injection attacks and dangerous patterns. Detects: prompt injection, jailbreak/DAN attempts, role hijacking, SQL injection (UNION/DROP/OR 1=1), XSS, Python/JS/Shell code injection, path traversal, oversized payloads, null bytes. Returns safe=true/false with finding list and block/allow decision.

payment

payment_policy_check

Validate a payment against policy rules before execution. Checks amount limits (>100k warns, >1M blocks), recipient allowlist/denylist, supported currencies/networks, AML reporting thresholds, and MiCA flags. Returns approved/rejected with full violation list and risk score.

rate

rate_limit_check

Check if an agent has exceeded rate limits. Returns per-window usage (minute/hour/day) with percentage used. Limits: 200/min, 5000/hr, 50000/day per agent. Use before high-frequency tool calls or for agent health monitoring.

replay

replay_guard_check

Detect replay attacks — identical requests sent multiple times in a time window. Uses SHA256 fingerprint of (agent_id + tool_name + args). Default window: 300 seconds (5 min). Returns is_replay=true/false with duplicate count and first/last seen timestamps.

scope

scope_check

Check if agent has required scope for a tool. Roles: admin, compliance_officer, trader, auditor, developer, readonly. Returns has_scope + missing scope + granting roles.

secret

secret_exposure_check

Deep scan any text/payload for secrets, credentials, and PII. Detects: API keys (OpenAI, GitHub, AWS), tokens (Slack, Bearer), private keys (ETH, Bitcoin), credentials (passwords, secrets), and PII (emails, credit cards, SSNs). Returns findings with severity and remediation guidance.

session

session_validate

Create/validate/invalidate agent sessions with role, scopes, TTL and call budget. Actions: create|validate|invalidate|info.

spend

spend_limit_check

Check if a payment amount stays within agent spend limits. Default limits: 10,000/call, 50,000/hr, 200,000/day. Trusted agents: 100,000/call, 500,000/hr, 2,000,000/day. Returns within_limits=true/false with headroom percentage.

tenant

tenant_policy_check

Multi-tenant governance. Tenants: default, fintech_eu (MiCA/DORA), defi_protocol, enterprise_read. Checks tool blocklists, max risk scores, spend limits. Actions: check|list.

threat

threat_intel_check

Check entity against threat intelligence. Auto-detects ETH addresses, IPs, domains. Checks sanctions (Tornado Cash), disposable services, behavioral analysis from audit log. Returns threat_level: none|low|medium|high|critical.

Endpoints

URL	Transport	State	Latency	Checked
https://feedoracle.io/guard-oracle/mcp/	streamable-http	answering	7293 ms	9 min ago

Agentguard — questions

Answers built from our own checks of this server.

What can Agentguard do?

It exposes 24 tools, read directly from the server on our last check. Among them: approval_list, approval_required, approval_resolve, audit_log_query, audit_log_write, cross_tool_anomaly_check and 18 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

What is Agentguard mostly used for?

Its tools cluster around approval, tool and audit. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.

Is Agentguard working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 0 of 91 checks got a reply (0.0%), average response time 7293 ms. The bar chart above shows every period we have measured.

The registry lists Agentguard as active — why does it not respond?

The official MCP registry stores what the author submitted; it does not verify that the server still runs. We check the endpoint ourselves, and this one does not answer. Catalogues that copy the registry without checking will show it as working.

How do I connect Agentguard?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Agentguard need an API key?

No. Agentguard completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 24 of them are readable on this page. This is what we observed, not what the docs claim.

Is Agentguard open source?

Yes — written in Python and 0 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.