mcpguard-sdk wraps any tool handler with a deterministic policy check before it runs. CEL-based rules. Observe-first ramp. Framework-agnostic — OpenAI, Anthropic, LangChain, MCP, your own loop.
import { MCPGuard } from 'mcpguard-sdk'
const guard = new MCPGuard({ apiKey: process.env.MCPGUARD_API_KEY! })
// Drop-in gate. Throws MCPGuardDeniedError on policy deny.
await guard.enforce({
action_id: 'billing.refund',
params: { invoice_id, amount_cents },
user_context: { user_id, plan },
})
// → allow: continue. → review: human in the loop.
// → deny: thrown, the tool call is skipped.
await stripe.refunds.create({ charge, amount: amount_cents })packages/sdk/src/index.ts — real signature, not pseudocode.
One MCPGuard instance, one adapter import, one handler-map transform. Your dispatch code doesn't change — every tool call now flows through policy before it runs.
mcpguard-sdk/openaiimport { withMCPGuardOpenAI } from 'mcpguard-sdk/openai'
const handlers = withMCPGuardOpenAI(guard, {
'billing.refund': refundHandler,
'db.query': queryHandler,
})
// existing dispatch — unchanged
await handlers[call.function.name](args)mcpguard-sdk/anthropicimport { executeToolUseBlocks } from 'mcpguard-sdk/anthropic'
const results = await executeToolUseBlocks(
guard,
message.content.filter(b => b.type === 'tool_use'),
{ refund: refundHandler, query: queryHandler },
)
// feed `results` back as the next user turnmcpguard-sdkimport { MCPGuard, MCPGuardDeniedError } from 'mcpguard-sdk'
try {
await guard.enforce({ action_id, params })
await runMyTool(params)
} catch (e) {
if (e instanceof MCPGuardDeniedError)
return { skipped: true, rule: e.matched_rule }
throw e
}Works with LangChain, LangGraph, OpenAI Assistants, Anthropic tool use, MCP servers, Vercel AI SDK — anything that hands you a tool name and a params object. The SDK has no framework dependency; the adapters are structural duck-types.
The free-tier MCP server ships four tools that run fully local — no API key, no telemetry, no round-trip. Drop the snippet into your MCP client and your editor can author, validate, and test policy without leaving the buffer.
{
"mcpServers": {
"mcp-guard": {
"command": "npx",
"args": ["-y", "mcpguard-server"]
}
}
}Same shape works in Cursor, Claude Desktop, Continue, and any other MCP host. No env: block — the free tier is keyless on purpose.
mcpguard.policy_validateParse policy.yaml, walk the AST, lint against the DSL spec — before you ever ship a rule.
mcpguard.cel_testEvaluate a CEL predicate against a sample event payload. Same engine the gate uses in prod.
mcpguard.risk_pack_browseBrowse Healthcare / Fintech / Ops/IT risk packs with per-action rationale teasers.
mcpguard.schema_docsAction / policy / review schema documentation, bundled. No round-trip to a docs site.
> validate ./policy.yaml and tell me which rules would block billing.refund > $500 mcp-guard → calling mcpguard.policy_validate ✓ policy parses (3 rules) → calling mcpguard.cel_test matched_rule: refund.large_amount → review
The SDK ships with two policy modes and a clean transition between them. Same code, same call site — the only thing that changes is whether enforce() throws.
Install the SDK in observe mode. Every tool call is logged with the decision the policy would have made — allow, deny, review — but the call still runs.
The dashboard shows "if enforcing now, X% of refund.create calls would route to review." You tune rules against real traffic, not synthetic test cases.
Move `billing.refund` to enforce. Leave `db.query` in observe another week. Mode is per-action and per-environment — no big-bang rollout.
// observe mode: deny → allow + log. enforce mode: deny → throws MCPGuardDeniedError.
The SDK is free up to 10,000 evaluations / month on self-hosted or via the hosted free tier. Team plan is when you bring on the first reviewer — the dashboard, the review queue, the Slack approval bot.
For the dev evaluating, prototyping, or shipping a side project.
When the first reviewer — a PM, a comms lead, a support manager — needs to see the queue.
Business and Enterprise tiers add SSO, dedicated review queues, BAA, on-prem, and managed policy authoring. See the full pricing grid →