@agentguard-run/mcp

AgentGuard® as an MCP server: local spend caps and Ed25519-signed provenance receipts for AI agent actions, usable from any Model Context Protocol host (Claude Desktop, Claude Code, Cursor, Cline, or your own agent runtime).

Zero data plane. Tools accept metadata only: model names, token counts, endpoint URLs. Prompts and completions never pass through this server, and nothing leaves your machine. Receipts are content-free.

Install

{
  "mcpServers": {
    "agentguard": {
      "command": "npx",
      "args": ["-y", "@agentguard-run/mcp"]
    }
  }
}

Optional environment variables:

| Variable | Default | Meaning | |----------|---------|---------| | AGENTGUARD_MCP_DAILY_CAP_CENTS | 500 | Hard per-day spend cap (block on exceed) | | AGENTGUARD_MCP_PER_CALL_CAP_CENTS | 100 | Hard per-call spend cap (block on exceed) | | AGENTGUARD_MCP_TENANT | mcp-local | Tenant scope stamped into receipts | | AGENTGUARD_HOME | ~/.agentguard | Signing key and decision-ledger directory | | AGENTGUARD_MCP_LEDGER | ndjson | Persist signed decisions; memory restores process-only storage | | AGENTGUARD_ACTOR_DIGEST | unset | 1 stores SHA-256 digests of actor IDs; provider stays readable |

A signing keypair is generated on first run and persisted to <AGENTGUARD_HOME>/mcp-signing.json (0600). Signed decisions are appended to <AGENTGUARD_HOME>/<tenant>/decisions.ndjson, including the public verification key. Exports include prior process runs and new decisions extend the existing chain. Tenant directory names use the spend store's filename normalization. Spend counters remain process-local, as in earlier versions.

All tools accept optional agent_id, task_id, and workflow_id identifier parameters. spend_decide passes these to the call context, signing them as actor.agentId, actor.taskId, and actor.workflowId; the configured tenant becomes actor.tenantId. Other tools accept these metadata fields without recording a spend decision. Prompts, arbitrary content, credentials, and filesystem paths are rejected as IDs. Existing calls without these parameters keep working.

Tools

• spend_decide — gate a model call before it runs. Returns allow/block plus a signed, hash-chained receipt recording model identity, weights origin country (China-origin families such as GLM, DeepSeek, Qwen, and Kimi are flagged automatically), hosting jurisdiction, and retention posture. Unrecognized endpoints (vLLM, Ollama, TGI, your own cluster) route as self-hosted: zero retention, your jurisdiction.
• verify_receipt — independently verify any receipt. Change one signed byte and verification fails.
• export_receipts — export the tenant decision ledger as a verified hash chain, including earlier process runs. Memory mode exports only the current process.
• set_model_cost — register pricing for self-hosted models (AgentGuard fails closed on unknown costs).
• provenance_preview — see what would be attested for a model/endpoint without spending.
• spend_status — active caps, tenant, decision count, signer fingerprint.

Why

When agents move from hosted APIs to self-hosted models, the provider's spend dashboard, rate limits, and audit logs disappear with the provider. AgentGuard puts them back, locally, and adds something hosted providers never gave you: a cryptographic receipt an outsider can verify without trusting you or us.

More: https://agentguard.run/sovereign/ and https://agentguard.run/sovereign/guide/

Verify independently

Any receipt can be checked off-platform at https://agentguard.run/verify or with verify_receipt and the signer public key from spend_status.

Local release verification

Version 0.3.0 declares spend ^0.19.0. The repository lockfile resolves that version through the sibling file:../agentguard-spend link for unpublished development. Build spend first, then run this package's build and smoke test. Registry release order is spend 0.19.0 first, then MCP 0.3.0; regenerate the MCP lockfile against the registry after spend is available there.

AgentGuard® is a registered trademark of Dunecrest Ventures Inc. US patent filings pending. This package is governance software, not legal or compliance advice.