Agentguard

io.tooloraclePublished by tooloracle.iov1.0.0Updated Nov 2, 2026

AgentGuard — 20-tool AI safety MCP: policy preflight, risk scoring, audit logging, rate limits.

The publisher's own server: Accessoracle

VerifiedStreamable HTTPWeb executableFinance Security & Monitoring

Server details

Identifier: io.tooloracle/agentguard
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to tooloracle.io, but the endpoint is not on that domain, so the publisher may not run this server.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.tooloracle%2Fagentguard.svg)](https://sourceweft.com/mcp/io.tooloracle%2Fagentguard?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

AgentGuard is a remote MCP safety layer that lets an assistant preflight tool calls, score risk, check payments and secrets, and write signed audit logs.

What you can do: Run policy preflight and risk scoring on planned tool calls, with allow, deny, require-approval or flag decisions
Check payment policy, spend limits, rate limits and replay fingerprints before money-moving actions
Scan payloads and arguments for secrets, prompt injection, SQL/XSS/shell injection and other unsafe patterns
Validate sessions, roles and scopes, and apply multi-tenant governance rules
Query and write a signed audit trail, explain decisions, and check entity threat intelligence
When to use it: Worth adding when an assistant runs autonomous or money-moving tool calls and you need a policy gate, risk scoring and tamper-evident audit records, especially in regulated, multi-tenant or agent-commerce settings.
Requirements: A remote streamable HTTP endpoint reached through the mcp-remote bridge (Node.js/npx) or a direct HTTP connection; no API key or environment variable is declared. Network access to the provider's host is required.

Before you install

Tool arguments are sent to a third-party service for scanning, so secrets, keys and payment details in payloads leave your machine. The audit log is written and stored server-side. Decisions are advisory unless your client actually enforces them, and the built-in policies, tenants and limits are provider defaults you should review.

Installation

In SourceWeft

Open Agentguard in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.tooloracle%2Fagentguard/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "agentguard": {
      "type": "http",
      "url": "https://feedoracle.io/guard-oracle/mcp/"
    }
  }
}

README

🛡️ AgentGuard MCP

Security, Policy & Audit Layer for AI Agent Tool Execution — 20 tools | Part of FeedOracle & ToolOracle

[Tools] [Status] [Backend] [Tier]

AgentGuard is the governance and security layer for AI agent workflows. Before any tool executes, AgentGuard evaluates policies, scores risk, detects secrets and injection attempts, logs to a tamper-evident audit trail, and explains every decision. Built for regulated environments, autonomous payments, and enterprise AI agent deployments.

Quick Connect

bash

# FeedOracle (compliance-focused)npx -y mcp-remote https://feedoracle.io/guard/mcp/
# ToolOracle (agent-commerce focused)npx -y mcp-remote https://tooloracle.io/guard/mcp/

# FeedOracle (compliance-focused)npx -y mcp-remote https://feedoracle.io/guard/mcp/
# ToolOracle (agent-commerce focused)npx -y mcp-remote https://tooloracle.io/guard/mcp/

json

{  "mcpServers": {    "agentguard": {      "command": "npx",      "args": ["-y", "mcp-remote", "https://feedoracle.io/guard/mcp/"]    }  }}

{  "mcpServers": {    "agentguard": {      "command": "npx",      "args": ["-y", "mcp-remote", "https://feedoracle.io/guard/mcp/"]    }  }}

How It Works — The Agent Security Loop

Agent wants to call: payment_execute({amount: 5000})         │         ▼   policy_preflight()         ← Check before execution         │   risk_score: 95             ← Critical   matched: pol-001, pol-002  ← Payment + High-risk policies   decision: require_approval ← Human gate triggered         │   approval_required()        ← Register pending approval         │   [Human approves]         │   tool executes         │   audit_log_write()          ← Record outcome with signature         │   decision_explain()         ← Exportable compliance evidence

Agent wants to call: payment_execute({amount: 5000})         │         ▼   policy_preflight()         ← Check before execution         │   risk_score: 95             ← Critical   matched: pol-001, pol-002  ← Payment + High-risk policies   decision: require_approval ← Human gate triggered         │   approval_required()        ← Register pending approval         │   [Human approves]         │   tool executes         │   audit_log_write()          ← Record outcome with signature         │   decision_explain()         ← Exportable compliance evidence

Tools — Welle 1: Core Security (7)

Tool	Description
`policy_preflight`	Pre-flight check before any tool call. Evaluates 7 policies, computes risk score, detects threats, auto-logs. Returns `allowed`/`denied`/`require_approval`/`flagged`.
`tool_risk_score`	0-100 risk score for tool + input. Detects secrets (API keys, passwords), prompt injection, high-value amounts. `eth_gas`→5, `payment_execute`→95+.
`approval_required`	Check if tool needs human approval. Optionally registers a pending approval request with tracking URL.
`audit_log_write`	Write tool execution to persistent, cryptographically-signed audit log (SQLite WAL). Call after execution to record outcome.
`audit_log_query`	Query audit trail. Filter by agent, tool, decision, time range. Paginated. Returns signed entries for tamper verification.
`decision_explain`	Human-readable explanation of any allow/deny decision. Pass `request_id` for stored entry or `tool_name` + `tool_args` for fresh analysis.
`rate_limit_check`	Check agent rate limits: 200/min, 5000/hr, 50000/day. Returns per-window usage with percentage.

Tools — Welle 2: Payment Controls & Safety

Tool	Description
`payment_policy_check`	Validate payment against policy: amount limits (>100k warns, >1M blocks), recipient denylist, supported currencies/networks, AML thresholds (>10k fiat flagged), MiCA flags.
`spend_limit_check`	Check per-call/hour/day spend limits by trust level. Default: 10k/call, 50k/hr, 200k/day. Trusted: 100k/call, 500k/hr, 2M/day.
`secret_exposure_check`	Deep scan for 19 secret patterns: OpenAI/GitHub/AWS/Slack keys, Bearer/Basic auth, ETH private keys, Bitcoin WIF, credit cards, SSNs, emails. Returns severity + remediation.
`payload_safety_check`	18-pattern safety scan: prompt injection, jailbreak/DAN, role hijacking, SQL (UNION/DROP/OR 1=1), XSS, Python/JS/Shell injection, path traversal, null bytes, oversized payloads.
`replay_guard_check`	Detect replay attacks via SHA256 fingerprint (agent+tool+args). Configurable window (default 5 min). Returns duplicate count + first/last seen.

Tools — Welle 3: Governance & Threat Intelligence (5)

Tool	Description
`cross_tool_anomaly_check`	Detect anomalous patterns: risky combos (wallet-recon→transfer, AML→payment), high frequency, repeated denials (policy probing), broad reconnaissance, elevated avg risk score.
`scope_check`	Role-based scope control. Roles: admin, compliance_officer, trader, auditor, developer, readonly. Returns has_scope, missing scope, granting roles. Logs denials.
`session_validate`	Full session lifecycle: create (TTL + call budget), validate (increment counter), invalidate, info. Sessions carry role, scopes, tenant, expiry.
`tenant_policy_check`	Multi-tenant governance. Built-in tenants: default, fintech_eu (MiCA/DORA/AMLD6), defi_protocol, enterprise_read. Per-tenant blocklists, risk limits, spend caps.
`threat_intel_check`	Entity threat intelligence. Auto-detects ETH addresses, IPs, domains. Checks sanctions (Tornado Cash, mixers), disposable services, behavioral analysis from audit log.

Built-in Tenants

Built-in Roles & Scopes

Role	Scopes
`admin`	All scopes
`compliance_officer`	audit:read, compliance:read, blockchain:read, security:scan
`trader`	blockchain:read, payment:check, payment:execute, audit:read
`auditor`	audit:read, audit:write, compliance:read, monitor:read
`developer`	blockchain:read, security:scan, audit:read, monitor:read
`readonly`	blockchain:read, audit:read

Built-in Policies (7 Default)

Policy	Condition	Action
pol-001	Payment/transfer tools	`require_approval`
pol-002	Risk score ≥ 80	`require_approval`
pol-003	Secret/key in payload	`deny`
pol-004	Rate limit exceeded	`flag`
pol-005	Risk score ≤ 20	`allow` freely
pol-006	Prompt injection detected	`deny`
pol-007	Same tool > 50 calls/60s	`flag`

Risk Score Guide

Use Cases

Regulated AI Workflows: MiCA/DORA compliance requires audit trails — AgentGuard provides them automatically
Autonomous Payments: x402 agent payments run through approval_required gate before execution
Multi-tenant Platforms: Rate limiting and policy scoping per agent/session
Security Monitoring: Real-time detection of prompt injection and secret exposure in tool arguments
Compliance Reporting: Export audit log with cryptographic signatures for regulatory review

Backend: SQLite WAL-Mode

Persistent, stable, no daemon required. WAL-mode supports 1000+ writes/second. Shared between feedoracle.io and tooloracle.io — one source of truth.

Tools

SourceWeft has not read this server's tools yet.

Version history

v1.0.0LatestSep 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts
Declare a license in the repository or the registry entry.