{
  "markdown": "# 🛡️ AgentGuard MCP\n\n**Security, Policy & Audit Layer for AI Agent Tool Execution** — 20 tools | Part of [FeedOracle](https://feedoracle.io) & [ToolOracle](https://tooloracle.io)\n\n![Tools](https://img.shields.io/badge/MCP_Tools-20-10B898?style=flat-square)\n![Status](https://img.shields.io/badge/Status-Live-00C853?style=flat-square)\n![Backend](https://img.shields.io/badge/Backend-SQLite_WAL-4A90D9?style=flat-square)\n![Tier](https://img.shields.io/badge/Tier-Free-2196F3?style=flat-square)\n\nAgentGuard is the governance and security layer for AI agent workflows. Before any tool executes, AgentGuard evaluates policies, scores risk, detects secrets and injection attempts, logs to a tamper-evident audit trail, and explains every decision. Built for regulated environments, autonomous payments, and enterprise AI agent deployments.\n\n## Quick Connect\n\n```bash\n# FeedOracle (compliance-focused)\nnpx -y mcp-remote https://feedoracle.io/guard/mcp/\n\n# ToolOracle (agent-commerce focused)\nnpx -y mcp-remote https://tooloracle.io/guard/mcp/\n```\n\n```json\n{\n  \"mcpServers\": {\n    \"agentguard\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"mcp-remote\", \"https://feedoracle.io/guard/mcp/\"]\n    }\n  }\n}\n```\n\n## How It Works — The Agent Security Loop\n\n```\nAgent wants to call: payment_execute({amount: 5000})\n         │\n         ▼\n   policy_preflight()         ← Check before execution\n         │\n   risk_score: 95             ← Critical\n   matched: pol-001, pol-002  ← Payment + High-risk policies\n   decision: require_approval ← Human gate triggered\n         │\n   approval_required()        ← Register pending approval\n         │\n   [Human approves]\n         │\n   tool executes\n         │\n   audit_log_write()          ← Record outcome with signature\n         │\n   decision_explain()         ← Exportable compliance evidence\n```\n\n## Tools — Welle 1: Core Security (7)\n\n\n| Tool | Description |\n|------|-------------|\n| `policy_preflight` | Pre-flight check before any tool call. Evaluates 7 policies, computes risk score, detects threats, auto-logs. Returns `allowed`/`denied`/`require_approval`/`flagged`. |\n| `tool_risk_score` | 0-100 risk score for tool + input. Detects secrets (API keys, passwords), prompt injection, high-value amounts. `eth_gas`→5, `payment_execute`→95+. |\n| `approval_required` | Check if tool needs human approval. Optionally registers a pending approval request with tracking URL. |\n| `audit_log_write` | Write tool execution to persistent, cryptographically-signed audit log (SQLite WAL). Call after execution to record outcome. |\n| `audit_log_query` | Query audit trail. Filter by agent, tool, decision, time range. Paginated. Returns signed entries for tamper verification. |\n| `decision_explain` | Human-readable explanation of any allow/deny decision. Pass `request_id` for stored entry or `tool_name` + `tool_args` for fresh analysis. |\n| `rate_limit_check` | Check agent rate limits: 200/min, 5000/hr, 50000/day. Returns per-window usage with percentage. |\n\n\n## Tools — Welle 2: Payment Controls & Safety\n\n| Tool | Description |\n|------|-------------|\n| `payment_policy_check` | Validate payment against policy: amount limits (>100k warns, >1M blocks), recipient denylist, supported currencies/networks, AML thresholds (>10k fiat flagged), MiCA flags. |\n| `spend_limit_check` | Check per-call/hour/day spend limits by trust level. Default: 10k/call, 50k/hr, 200k/day. Trusted: 100k/call, 500k/hr, 2M/day. |\n| `secret_exposure_check` | Deep scan for 19 secret patterns: OpenAI/GitHub/AWS/Slack keys, Bearer/Basic auth, ETH private keys, Bitcoin WIF, credit cards, SSNs, emails. Returns severity + remediation. |\n| `payload_safety_check` | 18-pattern safety scan: prompt injection, jailbreak/DAN, role hijacking, SQL (UNION/DROP/OR 1=1), XSS, Python/JS/Shell injection, path traversal, null bytes, oversized payloads. |\n| `replay_guard_check` | Detect replay attacks via SHA256 fingerprint (agent+tool+args). Configurable window (default 5 min). Returns duplicate count + first/last seen. |\n\n\n\n## Tools — Welle 3: Governance & Threat Intelligence (5)\n\n| Tool | Description |\n|------|-------------|\n| `cross_tool_anomaly_check` | Detect anomalous patterns: risky combos (wallet-recon→transfer, AML→payment), high frequency, repeated denials (policy probing), broad reconnaissance, elevated avg risk score. |\n| `scope_check` | Role-based scope control. Roles: admin, compliance_officer, trader, auditor, developer, readonly. Returns has_scope, missing scope, granting roles. Logs denials. |\n| `session_validate` | Full session lifecycle: create (TTL + call budget), validate (increment counter), invalidate, info. Sessions carry role, scopes, tenant, expiry. |\n| `tenant_policy_check` | Multi-tenant governance. Built-in tenants: default, fintech_eu (MiCA/DORA/AMLD6), defi_protocol, enterprise_read. Per-tenant blocklists, risk limits, spend caps. |\n| `threat_intel_check` | Entity threat intelligence. Auto-detects ETH addresses, IPs, domains. Checks sanctions (Tornado Cash, mixers), disposable services, behavioral analysis from audit log. |\n\n### Built-in Tenants\n\n| Tenant | Max Risk | Spend/Day | Frameworks |\n|--------|----------|-----------|------------|\n| `default` | 70 | 100,000 | — |\n| `fintech_eu` | 60 | 500,000 | MiCA, DORA, AMLD6 |\n| `defi_protocol` | 80 | 10,000,000 | MiCA |\n| `enterprise_read` | 30 | 0 | — |\n\n### Built-in Roles & Scopes\n\n| Role | Scopes |\n|------|--------|\n| `admin` | All scopes |\n| `compliance_officer` | audit:read, compliance:read, blockchain:read, security:scan |\n| `trader` | blockchain:read, payment:check, payment:execute, audit:read |\n| `auditor` | audit:read, audit:write, compliance:read, monitor:read |\n| `developer` | blockchain:read, security:scan, audit:read, monitor:read |\n| `readonly` | blockchain:read, audit:read |\n\n\n## Built-in Policies (7 Default)\n\n| Policy | Condition | Action |\n|--------|-----------|--------|\n| pol-001 | Payment/transfer tools | `require_approval` |\n| pol-002 | Risk score ≥ 80 | `require_approval` |\n| pol-003 | Secret/key in payload | `deny` |\n| pol-004 | Rate limit exceeded | `flag` |\n| pol-005 | Risk score ≤ 20 | `allow` freely |\n| pol-006 | Prompt injection detected | `deny` |\n| pol-007 | Same tool > 50 calls/60s | `flag` |\n\n## Risk Score Guide\n\n| Score | Level | Action |\n|-------|-------|--------|\n| 0-14 | Minimal | Proceed freely |\n| 15-39 | Low | Proceed, log for audit |\n| 40-69 | Medium | Flag and proceed with caution |\n| 70-89 | High | Require human approval |\n| 90-100 | Critical | Block execution |\n\n## Use Cases\n\n- **Regulated AI Workflows**: MiCA/DORA compliance requires audit trails — AgentGuard provides them automatically\n- **Autonomous Payments**: x402 agent payments run through `approval_required` gate before execution\n- **Multi-tenant Platforms**: Rate limiting and policy scoping per agent/session\n- **Security Monitoring**: Real-time detection of prompt injection and secret exposure in tool arguments\n- **Compliance Reporting**: Export audit log with cryptographic signatures for regulatory review\n\n## Backend: SQLite WAL-Mode\n\nPersistent, stable, no daemon required. WAL-mode supports 1000+ writes/second. Shared between `feedoracle.io` and `tooloracle.io` — one source of truth.\n\n## Links\n\n- 🛡️ FeedOracle: `https://feedoracle.io/guard/mcp/`\n- 🔧 ToolOracle: `https://tooloracle.io/guard/mcp/`\n- 📚 Docs: [feedoracle.io](https://feedoracle.io)\n- 🏠 Platform: [tooloracle.io](https://tooloracle.io)\n\n---\n\n*Built by [FeedOracle](https://feedoracle.io) — Evidence by Design*\n",
  "bytes": 7513,
  "sha": "5935a19e1c6f3ef5b2cb369e2525a581025b6f5172ca2cd063e186c81bd07772",
  "repo_slug": "tooloracle/agentguard",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_tooloracle_agentguard_338034d6/readme"
}