FAQ
MCP Guard FAQ: how it works, accuracy, pricing and data
23 straight answers about the guard, where it fits, what it costs and what we store. Search, or pick a topic.
The basics
What MCP Guard is, in plain language.
What is MCP Guard, in one sentence?
Before your AI agent runs a tool call, you send the call and what the user asked for, and MCP Guard answers allow, ask or block, with the reasons and nine calibrated scores.
Why would an agent need a guard?
Agents act on tools: databases, shells, email, payments. They can misread a request, follow instructions hidden in a web page or document (prompt injection), invent arguments, or take a far bigger action than the user wanted. A check before execution catches some of these while they are still only proposals.
Do I need to be a developer to try it?
No. The live demo on the homepage runs without an account or key: pick an example or type a tool call and a request, and see the verdict. Putting it into your agent takes a developer a few lines of code.
What are the nine questions?
safe (is it safe to run now), violation (none, policy, scope, injection, goal drift, corrigibility), severity, destructive, exfiltration, injected (driven by a tool result rather than the user), approval_policy (auto-approve, require a human, reject), blast_radius (read-only, local or reversible, production or external) and args_grounded (are the arguments supported by the request).
How is the verdict decided?
By default: block if P(unsafe) is at least 0.8 or the policy head says reject; ask if P(unsafe) is at least 0.3, the policy head says require_human, or args_grounded is below 0.5; otherwise allow. Every score is in the response, so you can apply your own thresholds.
Is it only for MCP?
No. The name comes from the Model Context Protocol, and there is an MCP server (https://api.mcp-guard.ai/mcp) with the tools guard_check, guard_batch and usage. The REST API (POST https://api.mcp-guard.ai/v1/guard) works from any agent framework, gateway or sandbox. MCP Guard is independent and not affiliated with Anthropic or the MCP project.
Where it fits
Where to put the check in your stack.
Where do I call it from?
From the place where a tool call would otherwise just run: an agent framework’s pre-tool-call hook, an MCP client or gateway that routes calls to servers, or the tool proxy of a code-mode sandbox.
Why does it matter for code-mode agents?
When an agent writes code that calls tools, one step can fire many calls that no human reads. Every call still passes through the sandbox’s tool proxy, so that is where a guard can see each one.
Can I check several calls at once?
Yes. POST /v1/guard/batch takes up to 64 checks in one request and costs one credit per check.
What should I send?
At minimum the action (a string such as db.drop_table(users) or an object {tool, args}). The intent (what the user asked for) matters most after that. The trigger (user_request or tool_result), constraints and context improve the answer.
Does it replace my rules and permissions?
No. Keep deterministic rules for known-bad patterns, least-privilege credentials and approval flows for irreversible actions. The guard is one layer on top, for the cases your rules do not describe.
Accuracy & speed
What we measured, and how to read it.
How accurate is it?
On the held-out test half of R-Judge (304 agent safety trajectories), AUROC 0.855 against 0.824 for saroku-guard, an open 184M guard model. The difference is not yet statistically significant, so read it as on par with or better than that baseline. Test it on your own traffic before you rely on a threshold.
Will it catch everything?
No. It reduces risk; it does not guarantee safety. Some unsafe calls will be scored as safe and some safe calls will be flagged. That is why the scores are exposed and why it should sit alongside other controls.
How fast is it?
About 15 ms per full nine-question check on an RTX 4090 at batch size 1 (p95 about 23 ms), about 400 checks per second per GPU. Over the internet, add the network round trip, typically around 100 ms from Europe.
What model is it?
DeBERTa-v3-base (184M parameters) fine-tuned on about 31k labelled agent actions: public agent-safety data plus our own labelled benign and adversarial tool calls. The response names it as mcp-guard-deberta-v1.
What if the guard is down or slow?
You get a 503 (nothing is charged) and should retry. Decide in advance what your agent does meanwhile: for irreversible actions, failing closed (ask a human) is usually the safer default. Live status is at /status.
Pricing
What it costs.
How much does it cost?
$0.20 per 1,000 checks. One check is one tool call judged on all nine questions. Packs from $5, monthly plans from $19 with bonus checks. Failed calls are free.
Do I need a credit card to start?
No. Every workspace gets 1,000 free requests (a batch request counts once). After that you add a card to buy a pack or a plan.
Is there an SLA?
Not on self-serve plans. Live health is at /status. Email support@mcp-guard.ai to discuss larger volumes.
Data & hosting
Where checks run and what we keep.
Where are checks processed?
Inference runs on our GPUs in Switzerland. The API edge runs on Cloudflare. Account data (users, workspaces, keys, billing) is in Supabase, EU region (Zurich).
Do you store my tool calls?
No. Request payloads (action, intent, context, conversation) are processed in memory and not stored.
What do you keep about my requests?
Request metadata: request id, time, endpoint, verdict, latency, credits charged and status. It is kept for 30 days for billing and debugging.
Do you have SOC 2 or ISO 27001?
No. We do not hold security certifications today. The security page describes what we actually do.
Still wondering?
The fastest way to understand the guard is to check a tool call.