MCP Guard vs Llama Guard

Llama Guard, introduced by Meta in "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations" (Inan et al., 2023), is a language model fine-tuned to classify a user prompt or a model response as safe or unsafe and to name the hazard categories involved. Llama Guard 3 aligns its categories with the MLCommons hazard taxonomy, and its model card lists categories such as violent crimes, privacy and, for tool-using setups, code interpreter abuse.

That is content moderation: is this text harmful to produce or to answer?

MCP Guard addresses action safety: given what the user asked, should this specific tool call run now? Most dangerous agent actions are content-neutral. terraform destroy in the wrong workspace, a DELETE without a WHERE, or forwarding a customer list to an address that appeared in a web page contain nothing a content taxonomy would flag.

For each proposed action, MCP Guard returns a verdict and nine scores in one pass: whether it is safe, the violation type (policy, scope, injection, goal drift, corrigibility), severity, whether it is destructive, whether it exfiltrates data, whether it was injected, the approval policy, the blast radius, and whether its arguments are grounded in the user's request.

It uses the same inputs a human reviewer would want: the action, the user's intent, what triggered it, constraints ("staging only") and recent conversation.

Llama Guard is a generative model: Llama Guard 3 comes in 8B and 1B sizes, and it produces its label as text. MCP Guard is a 184M-parameter DeBERTa-v3-base encoder that produces all nine scores in a single forward pass. We measured about 15 ms per full check on an RTX 4090 (p95 about 23 ms, batch 1), plus the network round trip for the hosted API. We have not benchmarked Llama Guard's latency and do not quote a figure for it; it depends heavily on hardware and serving setup.

Llama Guard is open weights, so you can self-host it. MCP Guard is offered as a hosted API and MCP server.

• A chat assistant without tools, or a public-facing bot where the main risk is harmful text: Llama Guard (or a similar content-safety model) is the right choice. An action guard has nothing to check.
• An agent that writes, deletes, spends or sends: check each consequential tool call with an action guard. A content classifier will pass most harmful actions because nothing in them is offensive.
• Both: many agents are also chat products. Moderate the conversation with a content model and gate the actions with MCP Guard. They do not overlap much, which is exactly why both are useful.

Neither guarantees safety. Keep least-privilege credentials and deterministic rules underneath.