agentguard-gateway

A self-hosted firewall for AI agents. AgentGuard is a transparent MCP gateway: it sits between your agent (Claude Desktop, Cursor, any MCP client) and the tool servers it calls, intercepts every tools/call, applies a deterministic allow / deny / ask policy, and streams a full audit trail to your own control plane — where risky calls wait for a human click.

Agent (MCP client)  ⇄  agentguard  ⇄  your MCP server (filesystem, shell, github, …)
                          │
                          ▼
              your dashboard: live feed, ask-queue, AI risk + OWASP mapping, EDR correlation

Live demo (nothing to install): https://dashboard-steel-two-88.vercel.app/demo

Quick start

Wrap any MCP server by putting agentguard in front of the command your client runs. Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y", "agentguard-gateway",
        "--name", "filesystem",
        "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/tmp"
      ]
    }
  }
}

Everything (initialize, tools/list, resources, prompts) is forwarded transparently; only tools/call goes through policy. Without a policy file a conservative built-in applies: destructive shell commands and credential exfiltration are denied, everything else is allowed and logged.

Policy

First match wins. agentguard --policy policy.json -- <upstream…>:

{
  "default": "allow",
  "rules": [
    { "match": { "tool": "*", "argsRegex": "rm\\s+-rf|mkfs" }, "action": "deny", "reason": "destructive shell" },
    { "match": { "tool": "*", "argsRegex": "AKIA[0-9A-Z]{16}" }, "action": "deny", "reason": "credential in args" },
    { "match": { "tool": "fs_write" }, "action": "ask", "reason": "writes need approval" }
  ]
}

• allow → forwarded. deny → the agent gets a policy-refusal result; the upstream never sees the call.
• ask → the call is held until a human approves or denies it in the dashboard.
• Fail-safe: policy errors, timeouts, or an unreachable control plane resolve to deny/hold — never a silent allow. Enforcement is local and deterministic; no LLM sits on the blocking path.

Control plane

Point the gateway at your own Supabase-backed dashboard (see the starter kit — Docker image + migrations + step-by-step EDR integration guide):

export NEXT_PUBLIC_SUPABASE_URL=https://<project>.supabase.co
export SUPABASE_SERVICE_ROLE_KEY=<service-role key>
export AGENTGUARD_HOST=my-workstation   # must match your EDR's hostname for correlation

With env set, every call streams to the dashboard (live feed, audit log, ask-queue, AI risk scoring + OWASP Agentic Top 10 mapping, and correlation against your EDR's OS-level telemetry). Without env the gateway still enforces policy and logs to stderr; ask rules then resolve to the fail-safe (deny) since there is no queue to wait on.

Security model

• The gateway only forwards to the upstream command you configure — it never executes anything itself.
• Tool arguments are treated as untrusted data end-to-end.
• Deny messages don't leak policy internals to the agent.

License

Free to run for evaluating AgentGuard and governing your own agents — see LICENSE. The source code is not publicly available.