Skip to content

agentguard — policy proxy for agent tool calls

by agentwares · remote · no sign-in to list tools · v0.2.0 · published by GitHub user agentwares

Free spend report from an agent log, no key. Hosted proxies: caps, audit export, buy calls.

Deletes · 1Changes · 3
CompareRegistry entry

7 tools: 1 can delete or cancel things, 3 change things and 3 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http agentguard-cloud https://agentwares-agentguard.vercel.app/api/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

7 tools

Deletes or cancels 1Claude Code: deny
  • okgate_set_policyReplace a proxy's policy (YAML: mode, upstreams, classify, caps, loop, dry_run, approvals, alerts, chaos, drift).No findings

    Why it is in this group

    • The name "okgate_set_policy" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Replace a proxy's policy (YAML: mode, upstreams, classify, caps, loop, dry_run, approvals, alerts, chaos, drift). Validated before saving; takes effect within 30 seconds. Requires an account key.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Changes things 3Claude Code: ask
  • okgate_create_proxyCreate a hosted okgate proxy in front of an MCP server.No findings

    Why it is in this group

    • The name "okgate_create_proxy" says "create": a word for a change.
    Description, as the server wrote it
    Create a hosted okgate proxy in front of an MCP server. Returns the proxy id, the per-customer MCP URL and the proxy key (shown once). Point your agent's MCP client at the URL with `Authorization: Bearer <key>`. Requires an account key.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • okgate_export_auditExport a run's hash-chained audit entries (prev_hash, hash, redacted args) with the Merkle root, for disputes and questionnaires.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Export a run's hash-chained audit entries (prev_hash, hash, redacted args) with the Merkle root, for disputes and questionnaires. Verify offline with sha256(prev_hash + canonical(entry)). Requires an account key.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • okgate_recommend_allowlistLeast-privilege recommendation from the proxy's recorded calls: the minimal tool allowlist, argument keys used per tool, and the upstream tools never used (remove them first).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Least-privilege recommendation from the proxy's recorded calls: the minimal tool allowlist, argument keys used per tool, and the upstream tools never used (remove them first). No LLM call here; apply it in the dashboard. Requires an account key.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 3Claude Code: allow
  • okgate_get_pricingMachine-readable pricing for okgate hosted: bands (Starter/Pro/Team) with included tool calls per month, the 80% soft alert and 150% hard stop, features, the free trial allowance, …No findings

    Why it is in this group

    • The name "okgate_get_pricing" says "get": a word for reading.
    Description, as the server wrote it
    Machine-readable pricing for okgate hosted: bands (Starter/Pro/Team) with included tool calls per month, the 80% soft alert and 150% hard stop, features, the free trial allowance, `per_call` — buying tool calls outright at POST /api/v1/calls from a prepaid balance, which is the one purchase here an unattended agent can complete — and `one_time`: reports a person pays for once on Stripe Checkout, such as the $49 EU AI Act Article 50 readiness report. Same data as /pricing.json.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • okgate_get_runThe incident-shaped report for one run: counts (calls, reads, writes, faked, blocked, spend), the call timeline with decisions, dry-run mutations (what would have changed), ledger …No findings

    Why it is in this group

    • The name "okgate_get_run" says "get": a word for reading.
    Description, as the server wrote it
    The incident-shaped report for one run: counts (calls, reads, writes, faked, blocked, spend), the call timeline with decisions, dry-run mutations (what would have changed), ledger entries and the audit-chain verification. Requires an account key.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • okgate_spend_reportRead an agent log and report what it spent: totals, calls by tool and by class, estimated dollars by rail, loops, the largest single run, and — for every overspend — the okgate ban…No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read an agent log and report what it spent: totals, calls by tool and by class, estimated dollars by rail, loops, the largest single run, and — for every overspend — the okgate band whose cap would have stopped it, the exact cap, and the call that would have tripped it. Needs no account and no key. The log is read in the request and discarded; nothing is stored. Accepts an agentwares audit export (`agentwares.audit/v1`), a Claude Code session `.jsonl`, or a CSV/JSONL of tool calls with any of `tool`, `ts`, `class`, `amount_usd`, `rail`, `run_id`, `model`, `input_tokens`, `output_tokens`. Caps come from the proxy's own default policy, so a band named here refuses exactly what it says it refuses. Buying that band is a checkout a person completes; the calls-only purchase an unattended agent can complete is in `okgate_get_pricing` instead.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http agentguard-cloud https://agentwares-agentguard.vercel.app/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__agentguard-cloud__okgate_get_pricing",
      "mcp__agentguard-cloud__okgate_spend_report",
      "mcp__agentguard-cloud__okgate_get_run"
    ],
    "ask": [
      "mcp__agentguard-cloud__okgate_create_proxy",
      "mcp__agentguard-cloud__okgate_export_audit",
      "mcp__agentguard-cloud__okgate_recommend_allowlist"
    ],
    "deny": [
      "mcp__agentguard-cloud__okgate_set_policy"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as agentguard-cloud. Review it before you use it.