Guardion

Agent runtime governance.

Three things, one policy:

| | | |---|---| | MCP | Wrap any MCP server behind a local proxy that redacts PII and secrets and enforces guardrails on every tool call — in both directions. | | Agents | Install runtime hooks in a coding agent, so prompts and tool use are policy-checked as they happen. | | Shadow AI | Inventory every AI app, agent, MCP server, skill and plugin on a device, score each one, and report what changed. |

npm install -g @guardion/guardion      # or: npx -y @guardion/guardion <cmd>
guardion init                          # guided setup: pick what to protect, paste your key

• 🔐 DLP for MCP — reversible PII/secret redaction on tool input and output
• 🛡️ Guardrails — prompt injection, tool poisoning, rug pulls, custom detectors
• 🔎 Shadow AI discovery — 49 signatures plus structural discovery for tools nobody has catalogued yet
• 📇 Inventory — a fingerprinted catalog of the whole agent tool surface, with drift
• 🪝 Claude Code hooks — observe or block risky sessions and tools
• 🌐 Gateway — online DLP and guardrails on the LLM calls themselves
• 📦 Zero runtime dependencies · cross-platform (macOS · Linux · Windows)

Detection is policy-driven: what to redact or block, and where (input, output, or both), live in your Guard policy in the Guardion console — not hard-coded here.

guardion --help              the three topics
guardion mcp --help          everything MCP
guardion agents --help       everything agents
guardion shadow-ai --help    everything Shadow AI

Contents

1. MCP — DLP & guardrails · guide
2. Agents — hooks & discovery · guide
3. Shadow AI — device inventory
4. Inventory · guide
5. Gateway — DLP for LLM calls
6. Zero deps & cross-platform
7. CLI reference

1. MCP — DLP & guardrails

Guardion sits between the MCP client and the server. Every tool call and every result passes through it, so a secret never reaches the model and a poisoned tool description never reaches the agent.

guardion install mcp                                   # protect every MCP config found
guardion mcp --mode dlp -- npx -y some-mcp-server      # wrap one server
guardion mcp --mode dlp --url https://host/mcp         # wrap a remote server

Modes — dlp redacts and continues · enforce blocks on a policy hit · monitor reports only.

Reversible redaction. A value redacted on the way out is restored on the way back, so the tool still works on real data while the model only ever sees a placeholder. --trust trusted|untrusted sets the direction that matters for a given server.

Protecting configs rewrites each MCP entry to launch through the proxy:

guardion scan --mode mcp --dry-run     # show what would change
guardion scan --mode mcp --replace     # apply
guardion scan --mode mcp --revert      # undo

Full guide: docs/guides/mcp-proxy.md

2. Agents — hooks & discovery

guardion claude-code --mode hooks      # events to Guard API, no LLM proxy
guardion claude-code --mode gateway    # route model traffic through the gateway
guardion claude-code --mode full       # both
guardion claude-code --status
guardion claude-code --uninstall

Hooks see the session as it happens — prompts, tool calls, results — and can observe or block. Discovery finds what an agent can run:

guardion scan --mode agents            # agents on this machine
guardion scan --mode tools | skills    # tools / skills
guardion scan --mode full --inventory  # everything, reported to Guard

Full guide: docs/guides/hooks.md

3. Shadow AI — device inventory

An endpoint scanner that answers what a policy cannot: what is actually installed here, who owns it, and what changed.

guardion shadow-ai                          # scan, score, report locally
guardion shadow-ai --json                   # full snapshot
guardion shadow-ai --changes-only           # only what drifted
guardion shadow-ai --inventory              # send one batch at the end
guardion shadow-schedule --install --at 03:30      # recurring device scan

Dry run by default. Nothing leaves the device until --inventory.

It finds apps, binaries, packages, IDE extensions, 25+ MCP host dialects, skills, plugins, processes, services, containers and network egress — then does four things a plain inventory does not:

Scores each MCP server and skill. Rules run against the asset itself, including optionally handshaking a live MCP server to see the tools it really exposes. Severity (is it shadow?) and security band (is it dangerous?) stay separate until the end:

                    security band
severity      LOW      MEDIUM    HIGH     CRITICAL
  high        P2        P1        P0        P0
  medium      P3        P2        P1        P0
  low         P3        P3        P2        P1

A sanctioned, enterprise-licensed Claude Code running a filesystem MCP that exposes execute_command is still P1 — the finding a pure inventory cannot produce.

Resolves where each asset came from. Author, repository and source URL, from local install metadata, git remotes and a seed catalog — offline. What it cannot resolve it marks pending with a locator, for the backend to finish.

Finds tools nobody has catalogued. Signature matching cannot see a CLI agent released last week, and a clean report from a stale catalog is indistinguishable from a clean machine. So state directories are also matched structurally — an MCP config, a sessions store, an instruction file — and reported unnamed at low severity for the backend to identify.

Reports drift. A local fingerprint baseline turns "this exists" into "this changed", including an MCP server's tool surface changing without its config changing — a rug pull.

Plus licence and ownership (Claude, Codex, Cursor, Copilot, Cody, Gemini CLI, Amazon Q) from plaintext sources only, so a personal subscription on a managed device is visible — and timestamps: when each asset arrived, and when it was last used.

Safety

The scanner runs on endpoints, often as root under MDM, so it is built to be safe there:

• It never executes a discovered binary. Versions come from Info.plist, package.json, dist-info, Homebrew paths and the registry — never --version. Running a binary found in a user-writable directory while privileged is a local privilege-escalation vector.
• execFile only — never a shell, fixed argv, hard timeouts, output caps, and a trusted-command allowlist that deliberately contains no AI binaries.
• It never prints a secret, never decrypts the keychain, and never executes a credential helper — the helper's name is the evidence.
• No file contents leave the device. Paths, key paths, hashes and field names only, redacted before they are emitted and before they are hashed, so rotating a secret is not mistaken for drift.

Scanner package: shadow-ai/

4. Inventory

Discovery and Shadow AI both report to Guard, where the asset catalog lives — every MCP server, tool, skill and plugin your agents can reach, fingerprinted so a change is visible.

Full guide: docs/guides/inventory.md

5. Gateway — DLP for LLM calls

The full tier routes LLM traffic through the Guardion gateway — a reverse proxy that forwards your own provider key — extending governance from tools to the model:

• Online DLP — redact PII and secrets in prompts and completions inline
• Guardrails on LLM calls — prompt injection, moderation, custom detectors
• Correlation — an injected x-guardion-trace-id links each LLM call to its session and tool events

Provider-agnostic (Anthropic · Vertex AI · Bedrock · OpenAI); you keep your own LLM key. Enable with guardion claude-code --mode full or guardion init.

6. Zero deps & cross-platform

• Zero runtime dependencies. The spawned interposer (mcp-interpose.cjs + core/mcp/**) imports only Node builtins, so it runs on any endpoint with no node_modules. A CI guard fails the build if a runtime file ever imports a non-builtin.
• Cross-platform. Windows-safe process spawning (cmd.exe + verbatim args) and per-OS config/token paths: machine (/etc/guardion · %ProgramData%\Guardion) then user (~/.guardion), for MDM and enterprise rollout.
• Token resolution: GUARDION_TOKEN → OS keychain → /etc/guardion/token → ~/.guardion/token. Config lives in ~/.guardion/config.json; tokens never go in config.

CLI reference

guardion <topic> --help prints the full surface for one area. The essentials:

| Command | What it does | |---------|--------------| | guardion init | Guided setup: pick what to protect, paste your key, choose a policy and mode | | guardion token set\|get\|test\|clear | Manage your API token | | guardion install mcp | Scan and DLP-protect every detected MCP config | | guardion mcp [--mode …] [--trust …] [--policy …] -- <cmd> / --url <url> | Wrap one MCP server (alias: mcp-proxy) | | guardion scan [--mode full\|mcp\|tools\|agents\|skills] | Discover MCP servers, tools, skills, agents; --inventory reports to Guard | | guardion scan --mode mcp --dry-run \| --replace \| --revert | Preview / apply / undo config protection | | guardion claude-code [--mode hooks\|gateway\|full] | Govern Claude Code via hooks; --status, --uninstall | | guardion shadow-ai | Device-wide Shadow AI inventory; --inventory sends one batch | | guardion shadow-schedule --install | Recurring device scan (launchd · systemd · Scheduled Tasks) |

Exit codes for shadow-ai: 0 clean · 1 assets found · 2 error.

Environment variables

| Variable | Purpose | |----------|---------| | GUARDION_TOKEN | Your Guardion API key (or guardion token set) | | GUARDION_POLICY | Policy slug to evaluate against | | GUARDION_MODE / GUARDION_TRUST | dlp\|enforce\|monitor / trusted\|untrusted | | GUARDION_API_URL | Guard API base URL (default https://api.guardion.ai) | | GUARDION_FAIL_CLOSED | true to deny when Guard is unreachable (default: fail-open) | | GUARDION_ACCOUNT_SALT | Per-deployment salt for account-hint hashing (Shadow AI) |

Requirements

• Node.js ≥ 18. Reading Cursor and Copilot entitlements needs node:sqlite, which arrived in Node 22.5 — below that those licences are reported as undetermined rather than absent.
• A Guardion API key and a policy with the detectors you want (create one at guardion.ai)

License

MIT — Guardion secures your MCP clients and AI agents from data leaks (DLP / PII anonymization), prompt injection, tool poisoning, and risky actions.