HIPAA BAAin auditEU residencyTamper-evident auditSecurity auditcompleteSOC 2 Type Iprogram planned

Ship agents your
security team will sign off on.

MCP Guard is the only agent guardrail that ships with engineer-reviewed risk classifications (counsel cobrand in progress — targeted GA), a tamper-evident audit chain, and an observe-first enforcement ramp. The compliance posture comes pre-built — your auditor gets the bundle they're used to, your CISO doesn't have to write the policy from scratch.

Start free What makes it defensible →

0brand-new policy DSLsCEL subset — same syntax as K8s admission control

3engineer-reviewed packsHealthcare · Fintech · Ops/IT — counsel cobrand at GA

100%of decisions auditedhash-chained, append-only

Auditor-ready

Security as the moat

Four things competitors can't credibly claim.

OPA is a generic policy engine. Lakera checks LLM output. Anthropic\'s native HITL is shallow and Anthropic-only. None of them ship the four things below — and three of them aren\'t engineering problems.

Engineer-reviewed risk packs (counsel cobrand in progress)

A rationale doc your CISO can actually read.

Each risk pack is a reference template: action catalog, starter policy, reviewer playbook, and an engineer-reviewed rationale document of its risk-classification statements. Outside-counsel cobrand letterhead for Healthcare and Fintech is in progress and lands at GA; Ops/IT is engineer-reviewed by design. You adopt or fork into your repo — the policy you ship is yours from day one.

A competitor still needs ~$50–200k of outside-counsel time per vertical to produce a comparable rationale doc.

Hash-chained audit log

Tamper-evident by construction.

Every evaluate decision lands as a row in an append-only audit table. Each row's hash links to the previous row's hash via a SECURITY DEFINER trigger that takes a FOR UPDATE lock per tenant — mathematical proof that nothing was deleted, reordered, or rewritten. Export the bundle, hand it to your auditor, done.

Exportable Evidence Bundle ready for any compliance audit out of the box.

Observe-first enforcement ramp

No surprise denials in production.

Default mode is observe: every call is evaluated, the would-be decision is recorded in the audit row, but the response is always allow. Roll out to a percentage. Watch the verdict ("if we'd been enforcing, X% would have blocked, top denied actions are A/B/C"). Flip to enforce per-action-id with AAL2 step-up and a 10-character typed reason. The same gate we use to switch on enforcement without an outage.

Generic policy engines (OPA, Cedar) and LLM guardrails ship in fail-closed mode.

Tool-call layer, not LLM I/O

We gate the action — the rest gate the text.

Lakera, Guardrails AI, NeMo Guardrails check the model's output (jailbreak, prompt injection, PII leak). That's a different security category. MCP Guard sits at the tool-invocation boundary: every `billing.refund`, `patient.delete`, `iam.grant` is intercepted before it touches your real systems. Higher signal, harder to fool, simpler to audit.

The only category where "deny" actually prevents harm — not just sanitizes a string.

Capability	Anthropic / OpenAI native	Built in-house
Tool-call interception	~	~
Engineer-reviewed risk packs (counsel cobrand in progress)
Tamper-evident audit chain		~
Observe-first enforcement ramp
Reviewer queue (HITL) included	~	~
Framework-agnostic SDK		~

Delivery layers

Three surfaces. Same policy.

The product is the SDK. Managed REST and the embeddable review UI are paid upgrades for customers who want us to run more of the stack. Pick the layer that matches your team — they all share one policy DSL and one audit chain.

Read the SDK docs →

SDK

mcpguard-agent-guard

In-process. Your policy never leaves your repo.

Drop the SDK into your TS or Python agent. Author policy.yaml in the same repo as your code, version-control it, ship it with your release. Sub-millisecond evaluation after first compile. We never see the rules.

Works with

TypeScriptPythonLangGraphOpenAIAnthropic

Managed REST

POST /v1/evaluate

For stacks that can’t run our code in-loop.

Same evaluator, hosted. Author policy via API or browser editor. Per-tenant rate limits, idempotency keys, p99 under 50ms for allow. Higher monthly price reflects the hosted SLA, not damages coverage.

Works with

GoRustElixirWebhookn8n

Review UI

<ReviewModal />

Drop-in human-in-the-loop, zero policy logic.

A React modal that prefills your own creation form with the agent’s proposed payload — the reviewer reviews in the same UI they’d use to create the entity manually. Or the headless useReviewQueue() hook for fully custom UIs.

Works with

ReactHeadless hookSlack botEmbeddable

Platform features

Boring on purpose.

An agent guardrail is a security control. We optimised for auditability and ramp safety, not novelty. The pieces below are the ones we kept after running this in production for two years.

Read the policy DSL spec →

YAML you can audit

CEL predicate subset — the expression language Kubernetes admission control uses. Security writes it, engineering reviews via PR, the engine evaluates deterministically. No invented language.

Observe-first ramp

Evaluate every call, write the audit row, return allow until you’re ready. Customers see what would have been blocked without affecting production. AAL2-gated flip with a typed reason.

Prompt-injection defense, in depth

Three tiers in the hot path: heuristic scorer, pgvector nearest-neighbour against a curated attack-signature corpus, optional LLM judge. Plus canary tokens, behavioural lockouts on repeat offenders, a schema-gate on tool arguments, and an output-scanner. Every signal lands in the same hash-chained audit log, so detection becomes evidence.

Tamper-evident audit

Every decision writes a hash-chained row to Chainlog. FOR UPDATE on chain_seq + 1 — the pattern we settled on after the chain-drift incident. Export as a signed Evidence Bundle for any compliance audit.

Framework-agnostic

Anthropic tool-use wrapper, OpenAI Assistants patcher, LangGraph node, LangChain callback, CrewAI decorator, Mastra step, n8n custom node, webhook adapter for everything else.

Risk taxonomy packs

Healthcare, Fintech, Ops/IT — populated action catalog + starter policy + reviewer playbook + engineer-reviewed rationale doc (counsel cobrand in progress for Healthcare/Fintech, lands at GA) you can hand to your CISO. Adopt as-is or fork. The policy you ship is your policy, full stop.

Policy DSL

YAML. CEL predicates. First-match-wins.

Last-match-wins is hard to debug and worse to audit. CEL is the expression language Kubernetes admission control uses — OPA / Cedar-fluent customers find the syntax familiar. We do not invent a new language.

policy.yaml✓ valid

# fintech-baseline.yaml
- id: refund_over_1000
  when: action.id == "billing.refund"
        && params.amount_cents > 100000
  decision: review
  require_role: finance_manager
  sla_minutes: 30

- id: critical_two_reviewers
  when: action.risk_level == "CRITICAL"
  decision: review
  require_2_reviewers: true
  sla_minutes: 60

- id: non_admin_patient_delete
  when: action.id == "patient.delete"
        && user_context.role != "admin"
  decision: deny
  reason: "patient.delete is admin-only"

- id: night_writes_review
  when: "'write' in action.side_effects
        && request.hour_utc in [22,23,0,1,2,3,4,5]"
  decision: review
  reason: "after-hours write — confirm intent"

- id: default_allow
  when: "true"
  decision: allow

Local validator·No network call from the MCP policy_validate tool.

allow

Decision returns immediately. Audit row written. Agent proceeds.

review

Persists a queue row, notifies via webhook or Slack, blocks the agent loop until a human resolves it. Reviewer can amend params before approving.

deny

Agent gets a structured refusal with the matched rule id and reason. Decision is final.

Linter + simulator

Unreachable-rule warnings catch dead branches after when: "true". The /v1/policies/:id/simulate endpoint replays the last N audit rows against a draft before you ship — the pre-commit hook ships with the SDK.

MCP server

The first guardrail
as MCP middleware.

MCP Guard ships two MCP packages. mcpguard-server exposes the policy + reviewer tools to your editor — free-tier tools work fully local, no API key, no network. mcpguard-guard is the meta-wrapper that intercepts arbitrary downstream MCP servers (Stripe, Chainlog, custom) and runs every tool invocation through policy before it proxies through.

~/.config/claude/claude_desktop_config.json

{
  "mcpServers": {
    "axiomgate-guard": {
      "command": "npx",
      "args": ["-y", "mcpguard-guard",
               "--config", "./mcp-guard.yaml"],
      "env": {
        "MCPGUARD_API_KEY": "mcg_live_xxx",
        "STRIPE_SECRET_KEY":  "sk_live_xxx"
      }
    }
  }
}

After this swap the agent sees one MCP server which transparently re-exposes Stripe + Chainlog + internal tools — all behind policy. No code changes to the downstream servers themselves.

Free tier — local, no key

Fully local. Zero network. The authoring loop must be unobservable from our side.

mcpguard.policy_validate
Parse policy.yaml, walk the AST, validate against the DSL spec.
mcpguard.cel_test
Evaluate a CEL predicate against a sample event payload.
mcpguard.risk_pack_browse
Browse Healthcare / Fintech / Ops pack indexes with per-action rationale teasers.
mcpguard.schema_docs
Action / policy / review schema documentation, bundled.

Gated — bearer token

Send request payloads only — never policy YAML. Same SDK-first posture as the library.

mcpguard.evaluate
Policy decision for a candidate action — the hot path.
mcpguard.reviews.{list,approve,reject}
Reviewer queue management from inside Cursor or Claude Desktop.
mcpguard.policies.simulate
What-if replay of policy drafts against historical audit rows.
mcpguard.observation.rollup
Observe-mode aggregates: "if enforcing now, X% would block".

How it works

Battle-tested. Generalised.

The pieces ported from a production HITL stack — without the medical specificity.

Customer-authored policy

You write the rules. We execute them.

MCP Guard is the Auth0 model for agent tool calls. Auth0 doesn’t decide who is allowed in your application — you do, and Auth0 enforces it. MCP Guard doesn’t decide which agent actions need a human — you do, and MCP Guard enforces it. A misconfigured policy is a customer bug, not an infrastructure outage. That contract is the only reason this product is shippable.

Observe before you enforce

No surprise denials in production.

Default mode is observe: every call is evaluated, every row is audited, every return value is allow. Open the dashboard, see "if we’d been enforcing, X% would have been blocked, top denied actions are A/B/C". Flip to enforce per-action-id, with AAL2 step-up and a 10-character typed reason — the gate we use to switch on enforcement.

Proof in practice

From the team that shipped it first.

“We built this stack because we had no other choice — clinical-action HITL is not optional when agents can refund accounts or modify prescriptions. Two years and 3000+ action-catalog rows later, MCP Guard is the same engine, generalised. The reviewer UX, the observation rollup, the hash-chained audit — every piece carries a scar from a real incident.” — Will Abhamon, founder.

Pricing

Built around moments, not feature checklists.

Free is the SDK with a real eval cap so you can ship. Team starts the day a non-engineer joins the review queue. Business adds the compliance bundle and your first risk pack. Enterprise is the managed-policy MSA. Risk packs are the moat and priced as standalone annual SKUs.

SDK (Free)

$0/ mo · 10k evals

TS + Python SDK with local policy evaluation. Self-hosted.

TS + Python SDK
10,000 evaluations / month
Then $0.001 per eval over the cap
MCP local tools (policy_validate, cel_test, risk_pack_browse, schema_docs)
Browseable risk-pack index
Community support

Start free

First reviewer

Team

$799/ month

Your first non-engineer reviewer. The moment compliance, ops, or clinical staff can approve agent actions without an engineer in the loop.

1 reviewer seat
Hosted review queue
Slack approver bot
Observation rollup analytics
Email support

Try Team

Business

$3,499/ month

Reviewer team + audit evidence + one risk pack on the house.

5 reviewer seats
SSO / SAML
Dedicated review queue
Chainlog Evidence Bundle export
One risk pack included (Healthcare, Fintech, or Ops/IT)
Priority support

Talk to sales

Enterprise

$249/ reviewer seat / month

25-seat min · +$50k/yr platform floor · ~$124.7k ARR floor · annual

Managed policy authoring under MSA + BAA + BYOK + on-prem. 25-seat minimum, $50k/yr platform floor.

Everything in Business
Hosted policy authoring (we draft + maintain your rules)
Engineer-reviewed pack rationale documents (counsel cobrand in progress — targeted GA)
White-label
BYOK + on-prem container
HIPAA BAA

Talk to sales

Risk packs

The moat. Sold as standalone annual SKUs.

Each pack is a populated action catalog + starter policy + reviewer playbook + rationale doc. Healthcare and Fintech ship engineer-reviewed today with outside-counsel cobrand in progress (letterhead lands at GA); Ops/IT is engineer-reviewed by design because it is internal SRE territory, not a regulator-facing surface.

Counsel cobrand in progress

Healthcare risk pack

$25k/ yr

Engineer-reviewed · Counsel cobrand in progress — targeted GA

Engineer-reviewed rationale doc (outside-counsel cobrand letterhead at GA), action catalog (PHI read, prescription create/modify, claim submit, consent capture, lab order release), starter policy, reviewer playbook.

Counsel cobrand in progress

Fintech risk pack

$25k/ yr

Engineer-reviewed · Counsel cobrand in progress — targeted GA

Engineer-reviewed rationale doc (outside-counsel cobrand letterhead at GA), action catalog (refund over threshold, account close, KYC override, ledger entry, transfer create, card issue), starter policy, reviewer playbook.

Ops/IT risk pack

$7.5k/ yr

Engineer-reviewed · Internal SRE concern — not regulator-facing

Action catalog (production deploy, secret rotate, IAM grant, infra delete, DB migration, prod feature-flag flip), starter policy, reviewer playbook. No outside counsel needed.

Meta-wrapper

mcpguard-guard

Free · MIT OSS

npm package for guarding any other MCP server (Stripe MCP, GitHub MCP, customer-built). Monetized indirectly through downstream evaluate calls.

Professional services

$25k–$75k

per engagement

Policy authoring sprint, audit prep, or custom adapter. Fixed scope, fixed price, usually 2–6 weeks.

White-label / on-prem

+50% multiplier

on Enterprise floor + $25k one-time setup

Customer-controlled deployment. Ship MCP Guard inside your own product or your own cloud account; we provide the binary, you operate it.

Grandfather clause. Existing free-tier users created before 2026-09-01 are grandfathered for 6 months at current limits. New pricing applies on renewal after that window.

Enterprise footnote: MCP Guard is software, not insurance. Software warranty, uptime SLA, and indemnification scope are bounded and set in the Terms of Service or, for Enterprise, the MSA. We do not indemnify consequential damages from your agents.

Ship agents yoursecurity team will sign off on.

A rationale doc your CISO can actually read.

Tamper-evident by construction.

No surprise denials in production.

We gate the action — the rest gate the text.

SDK

Managed REST

Review UI

YAML you can audit

Observe-first ramp

Prompt-injection defense, in depth

Tamper-evident audit

Framework-agnostic

Risk taxonomy packs

You write the rules. We execute them.

No surprise denials in production.

From the team that shipped it first.

Ship agents your
security team will sign off on.