Skip to content
MCP Guard
Get an API keyGet a key
Hosted in SwitzerlandChecks run on our GPUs in Switzerland, with EU failover (Swiss-only available). Payloads are not stored.

Product

Try it liveQuickstartMCP serverPricingStatusAPI reference

Learn

ExplainersUse casesGlossaryCompareSecurity

Resources

DocsFAQBlogBrand
Pricing
Log in

Quickstart

MCP Guard checks a tool call before your agent runs it. You send the action and what the user asked for; you get back a verdict (allow, ask or block), the reasons, and calibrated scores for nine questions, from one forward pass of a small model.

1. Create a key

Create an account. Every workspace starts with 1,000 free requests (a batch counts once); after that it is $0.20 per 1,000 checks, 1 credit per check. In the dashboard, open API keys and create one. It is shown once; store it as MCP_GUARD_API_KEY.

2. Check an action

Base URL https://api.mcp-guard.ai. Send the key as Authorization: Bearer mcpg_live_…. Here an agent that was asked to list tables proposes dropping one:

cURLbash
curl https://api.mcp-guard.ai/v1/guard \
  -H "Authorization: Bearer mcpg_live_…" \
  -H "Content-Type: application/json" \
  -d '{"action":{"tool":"db.drop_table","args":{"table":"users"}},"intent":"List the tables in the staging database","trigger":"user_request","context":"Database agent. Environment: production."}'
Request fieldDescription
actionrequiredstring | {tool, args}The tool call about to run: "db.drop_table(users)" or {"tool": "db.drop_table", "args": {"table": "users"}}.
intentstringWhat the user asked the agent to do. The most useful field after the action: most unsafe calls are only unsafe relative to the request.
triggerenumuser_request (the default when omitted), tool_result, correction or user_override. Send tool_result whenever the action was suggested by a tool output, a web page, an email or a document: that is how prompt injection is caught, and without it an injected action looks user-requested.
constraintsstring[]Rules the action must respect, e.g. "staging only", "never email outside acme.com". Up to 32.
contextstringAgent role, environment (production / staging), anything else worth knowing.
user_messagestringThe latest user message, when it differs from the intent.
conversation{role, content}[]Recent turns, oldest first, up to 50. The model reads about 384 tokens per check in total: longer input is trimmed (newest turns and recipient or target fields are kept) and the response says truncated: true. Put the decisive part in action and intent, and send only relevant context.

3. Read the verdict

200 OKjson
{
  "id": "grd_3f9c0a…",
  "verdict": "block",
  "p_unsafe": 0.9597,
  "reasons": [
    "destructive",
    "arguments not supported by the request",
    "scope violation"
  ],
  "scores": {
    "safe": 0.0403,
    "violation": {
      "none": 0.0234,
      "policy_violation": 0.0768,
      "scope_violation": 0.383,
      "injection": 0.0552,
      "goal_drift": 0.3826,
      "corrigibility": 0.079
    },
    "severity": {
      "expected": 2.61,
      "level": "high",
      "probabilities": [
        0.03,
        0.08,
        0.14,
        0.75
      ]
    },
    "destructive": 0.9987,
    "exfiltration": 0.0214,
    "injected": 0.0311,
    "approval_policy": {
      "auto_approve": 0.0122,
      "require_human": 0.1105,
      "reject": 0.8773
    },
    "blast_radius": {
      "expected": 1.93,
      "level": "production-mutating or external side effect",
      "probabilities": [
        0.01,
        0.05,
        0.94
      ]
    },
    "args_grounded": 0.2135
  },
  "model": "mcp-guard-deberta-v1",
  "latency_ms": 14.8
}

Run the action on allow, ask a human on ask, do not run it on block. Values above are illustrative.

FieldDescription
verdictallow | ask | blockThe default policy applied to the scores. See the verdict rule.
p_unsafenumber 0–11 − scores.safe.
reasonsstring[]Short reasons, e.g. "destructive", "possible data exfiltration". Empty when nothing stands out.
scoresobjectNine calibrated answers. See scores & verdicts.
idstringRequest id (grd_…), also in the x-request-id header.
latency_msnumberModel time for the check. Add your network round trip.
truncatedboolean, optionalTrue when the check was longer than the model reads and was trimmed. Send less context if you see it often.
tokens_readinteger, optionalTokens the model read for this check.
model_versionstring, optionalIdentifies the exact model weights that answered; changes when the model is updated.
triggersobject[], optionalWhat drove the verdict: a policy rule or a score over its threshold. See triggers.

Every response, errors included, carries x-request-id; quote it when you contact support. A check also reports x-credits-charged (0 on a free request or a failure) and x-free-runs-remaining. Failed calls are free.

Many actions at once

When a plan or a generated script is about to fire several tool calls, send them together to POST /v1/guard/batch as {"checks": [...]} (up to 64). You get one result per check, in order; it costs 1 credit per check.

Next

MCP Guard reduces risk; it does not guarantee safety. Keep deterministic rules (allow-lists, sandboxes, least privilege) for the patterns you already know are bad, and use the guard for the rest.