Guardian Mcp

io.github.OdingardPublished by GitHub account Odingardv0.3.2Updated Nov 5, 2026

Routes agent tool calls through Guardian for ALLOW/ASK/DENY before execution.

VerifiedSTDIODesktop onlyProductivity & WorkflowSecurity & Monitoring

Overview

AI-generated overview

Routes an agent's tool calls through Guardian for an ALLOW/ASK/DENY decision before execution, with human approval and verifiable receipts.

What you can do
  • Propose a tool invocation to Guardian and get a deterministic ALLOW, ASK or DENY decision before anything runs
  • Collect an approved ASK request's capability and execute it, returning the execution receipt
  • Fetch machine-readable evidence receipts for a request id
  • Govern an existing MCP server by proxying it through Guardian
When to use it
Use it when an assistant takes consequential actions and you want a policy gate plus human sign-off before execution, and tamper-evident evidence afterwards. Suited to teams that need approval flows for payments, refunds, messages or other risky tool calls.
Requirements
Runs locally over stdio as the npm package @odingard/guardian-mcp. Needs a Guardian control-plane base URL in GUARDIAN_BASE_URL, an agent credential in GUARDIAN_AGENT_CREDENTIAL, and a default connection id in GUARDIAN_CONNECTION_ID; GUARDIAN_ADAPTER_ID is optional. Network access to the Guardian service is required.
Before you install
Requires a Guardian agent credential (GUARDIAN_AGENT_CREDENTIAL, gak_ prefix) that authorizes actions on your behalf. ALLOW decisions execute tool calls immediately, so policy configuration determines what runs without review. Tool arguments and receipts are sent to the Guardian control plane, and the hosted service has paid tiers beyond the free tier.

Installation

In SourceWeft

  1. Open Guardian Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[Guardian — human authority for AI]

Guardian SDK

[npm version] [MCP registry] [Guardian MCP server on mcprush] [License]

Human Authority Infrastructure for Autonomous AI. The agent proposes; the human decides. Every tool call an agent makes gets a deterministic ALLOW / ASK / DENY decision before it runs, and every execution produces a tamper-evident receipt you can verify without an account.

Hosted Guardian: guardian.odingard.com — free tier, no card required. Pricing: Free, Developer $99/month with 25,000 billable executions included, Business via sales.

Packages

PackageUse it whenDocs
@odingard/guardian-sdkYou call Guardian from your own agent code: createGuard for your own action code, plus the core client, receipts and approvalspackages/sdk
odingard-guardian (PyPI)You build in Python (LangChain, CrewAI, OpenAI Agents, Claude Agent SDK, plain code), sync or asyncpackages/python
@odingard/guardian-mcpYour agent speaks MCP (Claude, Cursor, …), with no code needed. guardian-mcp proxy governs any existing MCP serverpackages/mcp
@odingard/guardian-langchainYou build with LangChain.js / LangGraphpackages/langchain
@odingard/guardian-vercel-aiYou build with the Vercel AI SDKpackages/vercel-ai
@odingard/guardian-steelYour browser agent checks out on Steelpackages/steel

Quickstart

bash
npm install @odingard/guardian-sdk
ts
import { classifyRequestResult, createGuardianClient } from "@odingard/guardian-sdk";
const guardian = createGuardianClient({  baseUrl: "https://guardian-api.odingard.com",  credential: process.env.GUARDIAN_AGENT_CREDENTIAL!, // gak_… issued per agent});
const d = classifyRequestResult(  await guardian.request({    action: "tool.invoke",    connectionId: "con_…",    toolName: "refund_order",    arguments: { orderId: "ord_123" },  }),);
if (d.decision === "ALLOW") {  await guardian.execute({ requestId: d.requestId, capabilityToken: d.capabilityToken });}// ASK → held for a human (keep d.requestId, then guardian.claim). DENY → never runs.

Govern your own action code (any framework)

ts
import { createGuard } from "@odingard/guardian-sdk";
const guard = createGuard({ client: guardian, connectionId: "con_…" });const payInvoice = guard("pay_invoice", async (inv) => myPaymentProvider.pay(inv)); // your codeawait payInvoice({ invoiceId: "INV-1002", amountCents: 1_240_000, payeeId: "acme" });// ALLOW → your code runs + receipt. ASK → GuardianApprovalPending (resume() after approval). DENY → never runs.
python
from odingard_guardian import Guard, GuardianClient
guard = Guard(GuardianClient(credential=...), connection_id="con_…")
@guard("pay_invoice")def pay_invoice(invoice_id: str, amount_cents: int, payee_id: str): ...  # your code

Govern an MCP server you already use

bash
guardian-mcp proxy -- npx -y your-whatsapp-mcp-server

Full guides: packages/sdk · packages/python · packages/mcp.

Examples

Runnable demos in examples/ — each prints SIMULATED (local demo policy) or LIVE (real hosted Guardian or real published keys).

bash
npm install && npm run buildcd examplesnode verify-receipt.mjs         # LIVE, no account: verify a real receipt offline, then tampernode demo-classes.mjs           # the 7 demo classesnode steel-checkout.mjs         # Steel checkout → ASK → resumenode shopping-agent.mjs         # purchase → ASK, human approves, receiptnode prompt-injection-deny.mjs  # injected "export contacts" → DENYnode coding-agent-ask.mjs       # consequential command → ASKnode invoice-agent.mjs          # B2B invoices: ALLOW under $5k, ASK above, DENY unknown payee (createGuard)python python/invoice_agent.py  # the same, in Python (pip install odingard-guardian)

Repository layout

text
packages/sdk        @odingard/guardian-sdk      core clientpackages/mcp        @odingard/guardian-mcp      MCP serverpackages/langchain  @odingard/guardian-langchainpackages/vercel-ai  @odingard/guardian-vercel-aipackages/steel      @odingard/guardian-steelpackages/python     odingard-guardian (PyPI)    Python SDKexamples/           runnable demos

packages/sdk/src/contracts, packages/sdk/src/evidence, the SDK client, guard, lifecycle and receipts sources, and the Steel adapter sources are generated from the Guardian monorepo — don't edit them here. See CONTRIBUTING.md.

License

Apache-2.0

Source: README.md at commit d1c2608

Tools

3

guardian_invoke_tool

Propose a tool invocation to Guardian. ALLOW executes immediately and returns the execution receipt; ASK is held for human approval (call guardian_claim with the returned requestId after the human approves); DENY refuses the action with a reason code.

ParameterspurposetoolNamerequiredargumentsconnectionId

guardian_claim

Collect the capability for a request that was held as ASK and approved by the human, then execute it and return the receipt.

ParametersrequestIdrequired

guardian_receipt

Fetch the machine-readable evidence receipts for a request id.

ParametersrequestIdrequired

Version history

3
  1. v0.3.2LatestNov 5, 2026
  2. v0.3.0Nov 5, 2026
  3. v0.1.1Nov 1, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts