Guardian MCP Server

Model Context Protocol (MCP) server for Guardian Safety Gate — enables AI agents like Claude to evaluate and execute governed actions through a safety policy layer.

What is this?

This MCP server exposes Guardian's intent evaluation and execution API as native tools that AI agents can call. When an AI agent wants to perform a sensitive action (like sending a payment, deleting data, or issuing a refund), it can:

1. Call guardian_evaluate to check if the action is allowed by your policies
2. If allowed, perform the actual action
3. Call guardian_execute to confirm the execution back to Guardian for audit logging

Important: Guardian is a safety gate, not a self-driving controller. The AI can ask for permission and execute pre-approved actions, but it cannot approve intents, modify policies, or bypass human oversight. Those powers stay with humans.

Installation

For Claude Desktop

1. Install the server globally:

npm install -g guardian-safety-mcp

2. Add to your Claude Desktop config file.

macOS:

~/Library/Application Support/Claude/claude_desktop_config.json

Windows (direct download):

%APPDATA%\Claude\claude_desktop_config.json

Windows (Microsoft Store version):

%LOCALAPPDATA%\Packages\Claude_pzs8oxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "guardian": {
      "command": "guardian-mcp",
      "env": {
        "GUARDIAN_API_KEY": "your-guardian-api-key",
        "GUARDIAN_BASE_URL": "https://guardian-backend-orc1.onrender.com"
      }
    }
  }
}

Note: If guardian-mcp is not found on Windows, use the full path:

"command": "cmd",
"args": ["/c", "C:\\Users\\YOUR_USERNAME\\AppData\\Roaming\\npm\\guardian-mcp.cmd"]

3. Restart Claude Desktop

For Cursor / Other MCP Clients

Same installation, but refer to your client's MCP configuration docs.

Configuration

Set these environment variables:

• GUARDIAN_API_KEY (required): Your Guardian API key from Settings → API Keys
• GUARDIAN_BASE_URL (optional): Guardian backend URL (defaults to production)

Available Tools

guardian_evaluate

Check an action with Guardian before executing it.

Parameters:

• actionType (string, required): The type of action (e.g. payment.send, user.delete)
• payload (string, required): JSON string with the action data
• requester (string, optional): Identifier for the trigger source (e.g. claude-desktop, [email protected])
• projectSlug (string, optional): Project slug to scope this intent
• idempotencyKey (string, optional): Unique key to prevent duplicate evaluations
• testMode (boolean, optional): Run in test mode without consuming quota

Returns:

• decision: ALLOW, DENY, or REQUIRE_APPROVAL
• reason: Human-readable explanation
• intentRunId: ID for tracking this intent
• Full Guardian API response

guardian_execute

Confirm that an already-approved intent was executed.

Parameters:

• intentRunId (string, required): The intentRunId from guardian_evaluate
• payload (string, optional): The same payload used in the evaluate step

Returns:

• Confirmation of execution logged in Guardian

guardian_check_status

Check the current status of a pending intent.

Parameters:

• intentRunId (string, required): The intentRunId to check

Returns:

• Current status and decision of the intent

Example Usage

When Claude wants to send a payment, it will:

1. Evaluate the intent:

guardian_evaluate({
  actionType: "payment.send",
  payload: '{"amount": 1000, "recipient": "[email protected]"}',
  requester: "claude-desktop"
})

2. If ALLOW, Claude performs the actual payment via your payment API

3. Confirm execution:

guardian_execute({
  intentRunId: "intent_abc123",
  payload: '{"amount": 1000, "recipient": "[email protected]"}'
})

All actions are logged in your Guardian dashboard with full audit trail.

Development

# Install dependencies
npm install

# Build
npm run build

# Test locally
node dist/index.js

License

MIT

Links

• Guardian Dashboard
• Guardian Documentation
• MCP Protocol