agentguard — policy proxy for agent tool calls

io.github.agentwaresPublished by GitHub account agentwaresv0.2.0Updated Oct 27, 2026

Free spend report from an agent log, no key. Hosted proxies: caps, audit export, buy calls.

VerifiedStreamable HTTPWeb executableCloud & Infrastructure Security & Monitoring Data & Analytics

Server details

Identifier: io.github.agentwares/agentguard-cloud
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account agentwares for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.agentwares%2Fagentguard-cloud.svg)](https://sourceweft.com/mcp/io.github.agentwares%2Fagentguard-cloud?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Hosted policy proxy for agent tool calls: create proxies, set caps and policies, inspect runs, export audit chains and report spend.

What you can do: Create and configure hosted proxies in front of MCP servers, returning the proxy URL and key
Replace a proxy policy covering mode, upstreams, classification, caps, loops, dry-run, approvals, alerts and drift
Inspect a single run: call counts, timeline with decisions, dry-run mutations, ledger and audit-chain verification
Export hash-chained audit entries with a Merkle root for disputes and questionnaires
Report spend from an agent log, including totals, calls by tool, loops and which cap would have stopped an overspend
Recommend a least-privilege tool allowlist from recorded calls, and read machine-readable pricing
When to use it: Useful when an assistant runs agents that call many tools and you want spending caps, loop detection, approval gates and auditable records around them, or when you simply want a free spend report from an existing agent log.
Requirements: Remote streamable HTTP endpoint; no local install. An account key sent as an Authorization Bearer header is needed for proxy creation, policy changes, run inspection, audit export and allowlist recommendations. The spend report and pricing tools work without a key. An account can be created through the signup API.

Before you install

The account key is a secret sent in the Authorization header. Creating proxies returns a proxy key shown only once, and that key then guards the proxied MCP server. Policies can block, fake or dry-run tool calls, so a wrong policy changes what agents can do. Buying tool calls draws on a prepaid balance. Audit exports contain redacted arguments.

Installation

In SourceWeft

Open agentguard — policy proxy for agent tool calls in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.agentwares%2Fagentguard-cloud/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "agentguard-policy-proxy-for-agent-tool-c": {
      "type": "http",
      "url": "https://agentwares-agentguard.vercel.app/api/mcp"
    }
  }
}

README

This repository has no README.

Tools

okgate_get_pricing

Machine-readable pricing for okgate hosted: bands (Starter/Pro/Team) with included tool calls per month, the 80% soft alert and 150% hard stop, features, the free trial allowance, `per_call` — buying tool calls outright at POST /api/v1/calls from a prepaid balance, which is the one purchase here an unattended agent can complete — and `one_time`: reports a person pays for once on Stripe Checkout, such as the $49 EU AI Act Article 50 readiness report. Same data as /pricing.json.

Takes no parameters.

okgate_spend_report

Read an agent log and report what it spent: totals, calls by tool and by class, estimated dollars by rail, loops, the largest single run, and — for every overspend — the okgate band whose cap would have stopped it, the exact cap, and the call that would have tripped it. Needs no account and no key. The log is read in the request and discarded; nothing is stored. Accepts an agentwares audit export (`agentwares.audit/v1`), a Claude Code session `.jsonl`, or a CSV/JSONL of tool calls with any of `tool`, `ts`, `class`, `amount_usd`, `rail`, `run_id`, `model`, `input_tokens`, `output_tokens`. Caps come from the proxy's own default policy, so a band named here refuses exactly what it says it refuses. Buying that band is a checkout a person completes; the calls-only purchase an unattended agent can complete is in `okgate_get_pricing` instead.

Parameterslogrequireddetail

okgate_create_proxy

Create a hosted okgate proxy in front of an MCP server. Returns the proxy id, the per-customer MCP URL and the proxy key (shown once). Point your agent's MCP client at the URL with `Authorization: Bearer <key>`. Requires an account key.

ParametersmodeslugrequiredupstreamUrlrequiredupstreamName

okgate_set_policy

Replace a proxy's policy (YAML: mode, upstreams, classify, caps, loop, dry_run, approvals, alerts, chaos, drift). Validated before saving; takes effect within 30 seconds. Requires an account key.

ParametersproxyIdrequiredpolicyYamlrequired

okgate_get_run

The incident-shaped report for one run: counts (calls, reads, writes, faked, blocked, spend), the call timeline with decisions, dry-run mutations (what would have changed), ledger entries and the audit-chain verification. Requires an account key.

ParametersrunIdrequiredproxyIdrequired

okgate_export_audit

Export a run's hash-chained audit entries (prev_hash, hash, redacted args) with the Merkle root, for disputes and questionnaires. Verify offline with sha256(prev_hash + canonical(entry)). Requires an account key.