MCP Guard: guard every AI agent tool call before it runs

Pre-execution guard · REST API + MCP server

Your agent is about to delete a table, email a file or refund a payment. MCP Guard checks the call against what the user actually asked for and answers allow, ask or block, in about 15 ms per check on a GPU.

For developers: action + intent in, verdict + nine calibrated scores out. One POST, or an MCP server.

Try it live Start with 1,000 free requests

GPUs in Switzerland
Payloads not stored

{"action": "any agent tool call",
 "intent": "what the user asked for",
 → "verdict": "allow | ask | block",
   "scores": {"safe": 0.97, "injected": 0.02,
     "args_grounded": 0.94}}

Illustrative example, values written by hand to match the drawing. Try real checks in the demo below.

~15 ms
per check on an RTX 4090 (p95 ~23 ms)
9
calibrated scores per check, one pass
0.855
AUROC on R-Judge test half
$0.20
per 1,000 checks

Try it live

Check a tool call. See the verdict and the nine scores.

Pick an example or write your own: the action the agent wants to run and what the user asked for. Each check runs on the real model, free and without a key.

Pick an example or write your own tool call, then press Check this call. The verdict, the reasons and all nine scores appear here.

How it works

Action and intent in, verdict and nine scores out

The guard sits between the agent’s decision and the tool call. It reads the proposed action in the context of the request once, and answers before anything runs.

Your agent proposes a tool call

Before executing it, send the action (a string or {tool, args}) with what the user asked for. Add the trigger, constraints and context when you have them: they sharpen the answer.

POST /v1/guard
{
  "action": {"tool": "db.drop_table",
             "args": {"table": "users"}},
  "intent": "List the tables in the staging database",
  "trigger": "user_request",
  "context": "Database agent. Environment: production."
}

2
One forward pass answers nine questions
A 184M-parameter DeBERTa-v3 model fine-tuned on agent actions scores all nine questions at once. No text is generated. About 15 ms per check on an RTX 4090.
1safe
2violation
3severity
4destructive
5exfiltration
6injected
7approval_policy
8blast_radius
9args_grounded

You get a verdict and the scores

allow, ask or block, the reasons, and every calibrated score. Use the default verdict or set your own thresholds per score.

{
  "verdict": "block",
  "p_unsafe": 0.96,
  "reasons": ["destructive",
              "arguments not supported by the request",
              "scope violation"],
  "scores": {
    "safe": 0.04, "destructive": 0.99,
    "args_grounded": 0.21,
    "approval_policy": {"reject": 0.88, …},
    "blast_radius": {"level": "production-mutating …"},
    …
  },
  "latency_ms": 14.8
}

Where it sits

Wherever tool calls leave your agent

One check per call, at the point where the call would otherwise just run.

Agent frameworks

Call it from the pre-tool-call hook. The agent proposes a call, the hook sends it to the guard, and only an allow runs without a human.

MCP clients and gateways

Add the MCP server (https://api.mcp-guard.ai/mcp) or call the REST API from your gateway, so every tool call to every server is checked in one place.

Code-mode sandboxes

When an agent writes code that calls tools, dozens of calls can fire with no human watching. Put the guard in the sandbox’s tool proxy: every call passes through it.

The nine questions

Not one yes/no: nine answers you can act on

Every check returns all nine scores, so you can route on the one that matters to you: block anything destructive in production, ask a human when arguments are not grounded, log the rest.

safe: Probability the call is safe to run now.
violation: none, policy_violation, scope_violation, injection, goal_drift or corrigibility.
severity: none < low < medium < high.
destructive: Deletes, overwrites or irreversibly changes data.
exfiltration: Sends private data, secrets or another tenant’s data where it should not go.
injected: Driven by instructions from a tool result or document, not the user (prompt injection).
approval_policy: auto_approve, require_human or reject.
blast_radius: read-only < local or reversible write < production-mutating or external side effect.
args_grounded: The arguments are supported by what the user asked (no invented ids, amounts or recipients).

The default verdict: block when P(unsafe) is at least 0.8 or the policy head says reject; ask when P(unsafe) is at least 0.3, the policy head says require_human, or args_grounded is below 0.5; otherwise allow. You can apply your own thresholds to the scores instead.

Measured, with the caveats

How well it works, and how we measured it

Numbers you can check, each with the conditions it was measured under.

Accuracy · R-Judge, held-out test half (304 trajectories)

MCP Guard (mcp-guard-deberta-v1)0.855

saroku-guard (open 184M guard model)0.824

AUROC, axis from 0.5 (chance) to 1.0

R-Judge is a public benchmark of agent safety trajectories. The gap is not yet statistically significant: read it as on par with or better than an open guard of the same size, not as a leaderboard claim. The model is DeBERTa-v3-base (184M parameters) fine-tuned on about 31k labelled agent actions.

Latency · one full nine-question check

~15 ms: RTX 4090, batch 1 (p95 ~23 ms)
~400 / s: checks per second per GPU
~120 ms: on a CPU, 8 threads
+ ~100 ms: typical network round trip from Europe, over the internet

The model time is what the response reports as latency_ms. What your agent waits for is that plus the network, so batch checks (up to 64 per request) when a step fires several calls.

For developers

One POST before every tool call

Create a key in the dashboard, send the call and the intent, act on the verdict. Or add the MCP server and let the client call guard_check.

guard.shbash

curl https://api.mcp-guard.ai/v1/guard \
  -H "Authorization: Bearer $MCP_GUARD_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action": {"tool": "db.drop_table", "args": {"table": "users"}},
    "intent": "List the tables in the staging database",
    "context": "Database agent. Environment: production."
  }'

REST: POST https://api.mcp-guard.ai/v1/guard and /v1/guard/batch (up to 64 checks). MCP (Streamable HTTP): https://api.mcp-guard.ai/mcp.

Read the quickstart API reference MCP server

Limits

What it is not

A guard that overpromises is worse than none. Plan for these.

One layer, not the whole defence

Keep deterministic rules for known-bad patterns, least-privilege credentials and human approval for irreversible actions. The guard catches what those miss.

It can be wrong

Scores are probabilities. Some unsafe calls will score as safe and some safe calls will be flagged. Tune thresholds on your own traffic.

It sees what you send

It judges the action against the intent and context in the request. If the intent is missing or misleading, so is the answer.

Adds a network hop

About 15 ms of model time plus the round trip. Batch calls where you can; decide what your agent does if the guard is unreachable.

Pricing

$0.20 per 1,000 checks. 1,000 free requests to start.

Slide to your monthly volume. Pay as you go with packs, or a monthly plan from $19 with up to 15% more checks.

Checks per month: 100,000

1k50M

1 check = one tool call judged on all nine questions = 1 credit, at $0.20 per 1,000 checks. A batch of N checks costs N credits. Failed calls are free, and every workspace starts with 1,000 free requests.

Cheapest option · Starter

$19/ month

$19 plan + 250 extra checks at the list rate

Starter$19
Pay as you go$20
Pro$99
Scale$399

For reference (illustrative): an LLM judge on every call runs roughly $2–$5 per 1,000 calls, about $200–$500 at this volume.

See packs and plans

FAQ

Questions, answered

What is MCP Guard?

A hosted API that checks an AI agent’s tool call before it runs. You send the action (for example db.drop_table(users) or {tool, args}) and what the user asked for; it returns a verdict (allow, ask or block), the reasons, and calibrated scores for nine questions, from one forward pass of a small model.

Does it only work with MCP?

No. The REST endpoint (POST https://api.mcp-guard.ai/v1/guard) works with any agent framework as a pre-tool-call hook. MCP clients and gateways can also call it as an MCP server at https://api.mcp-guard.ai/mcp, with the tools guard_check, guard_batch and usage.

How accurate is it?

On the held-out test half of R-Judge, a public benchmark of agent safety trajectories (304 trajectories), it scores an AUROC of 0.855, against 0.824 for saroku-guard, an open 184M guard model. The difference is not yet statistically significant, so read it as on par with or better than that baseline, not as a ranking. Measure it on your own traffic before you rely on it.

How fast is it?

About 15 ms per full nine-question check on an RTX 4090 (p95 about 23 ms) at batch size 1, and about 400 checks per second per GPU. On a CPU with 8 threads it is about 120 ms. Calls over the internet add the network round trip, typically around 100 ms from Europe.

Does it replace my allow-lists and rules?

No. It is one layer. Keep deterministic rules for patterns you already know are bad (blocked commands, allow-listed domains, permission scopes). The guard is for the long tail your rules do not describe: actions that are off-intent, injected by a document, or riskier than the request justifies.

What does it cost?

$0.20 per 1,000 checks. One check is one tool call judged on all nine questions. Every workspace gets 1,000 free requests (a batch counts once). After that you buy packs or pick a monthly plan from $19. Failed calls are free.

Do you store my tool calls?

No. Request payloads (the action, intent, context) are processed in memory and not stored. We keep request metadata (ids, verdict, latency, credits) for 30 days for billing and debugging.

All questions

Guard your first tool call in five minutes

Create a key, paste the curl, and put the check in front of the calls you would least like to see go wrong.

Start with 1,000 free requests Read the docs

Guard every agent tool call before it runs