AgentGuard is the governance and security layer for AI agent workflows. Before any tool executes, AgentGuard evaluates policies, scores risk, detects secrets and injection attempts, logs to a…
ToolOracle — AI Agent Tool Infrastructure & Trust Runtime is an MCP project maintained in the tooloracle/agentguard repository. The maintainer describes its purpose as “AgentGuard is the governance and security layer for AI agent workflows. Before any tool executes, AgentGuard evaluates policies, scores risk, detects secrets and injection attempts…”. Read the project documentation for the complete scope.
The maintainer’s configuration uses https://feedoracle.io/guard/mcp/. Check the project’s account and authentication instructions when adding the endpoint to your client.
Project documentation · Repository · Discovery listing. This profile records the public documentation checked on 2026-10-08.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| policy_preflight | Pre-flight check before any tool call. Evaluates 7 policies, computes risk score, detects threats, auto-logs. Returns allowed/denied/require_approval/flagged. |
| tool_risk_score | 0-100 risk score for tool + input. Detects secrets (API keys, passwords), prompt injection, high-value amounts. eth_gas→5, payment_execute→95+. |
| approval_required | Check if tool needs human approval. Optionally registers a pending approval request with tracking URL. |
| audit_log_write | Write tool execution to persistent, cryptographically-signed audit log (SQLite WAL). Call after execution to record outcome. |
| audit_log_query | Query audit trail. Filter by agent, tool, decision, time range. Paginated. Returns signed entries for tamper verification. |
| decision_explain | Human-readable explanation of any allow/deny decision. Pass request_id for stored entry or tool_name + tool_args for fresh analysis. |
| rate_limit_check | Check agent rate limits: 200/min, 5000/hr, 50000/day. Returns per-window usage with percentage. |
| payment_policy_check | Validate payment against policy: amount limits (>100k warns, >1M blocks), recipient denylist, supported currencies/networks, AML thresholds (>10k fiat… |
| spend_limit_check | Check per-call/hour/day spend limits by trust level. Default: 10k/call, 50k/hr, 200k/day. Trusted: 100k/call, 500k/hr, 2M/day. |
| secret_exposure_check | Deep scan for 19 secret patterns: OpenAI/GitHub/AWS/Slack keys, Bearer/Basic auth, ETH private keys, Bitcoin WIF, credit cards, SSNs, emails. Returns… |
| payload_safety_check | 18-pattern safety scan: prompt injection, jailbreak/DAN, role hijacking, SQL (UNION/DROP/OR 1=1), XSS, Python/JS/Shell injection, path traversal, null bytes… |
| replay_guard_check | Detect replay attacks via SHA256 fingerprint (agent+tool+args). Configurable window (default 5 min). Returns duplicate count + first/last seen. |
| cross_tool_anomaly_check | Detect anomalous patterns: risky combos (wallet-recon→transfer, AML→payment), high frequency, repeated denials (policy probing), broad reconnaissance, elevated |
| scope_check | Role-based scope control. Roles: admin, compliance_officer, trader, auditor, developer, readonly. Returns has_scope, missing scope, granting roles. Logs… |
| session_validate | Full session lifecycle: create (TTL + call budget), validate (increment counter), invalidate, info. Sessions carry role, scopes, tenant, expiry. |
| tenant_policy_check | Multi-tenant governance. Built-in tenants: default, fintech_eu (MiCA/DORA/AMLD6), defi_protocol, enterprise_read. Per-tenant blocklists, risk limits, spend… |
| threat_intel_check | Entity threat intelligence. Auto-detects ETH addresses, IPs, domains. Checks sanctions (Tornado Cash, mixers), disposable services, behavioral analysis from… |
| Tenant | Max Risk |
| default | 70 |
| fintech_eu | 60 |
| defi_protocol | 80 |
| enterprise_read | 30 |
| Role | Scopes |
| admin | All scopes |
| compliance_officer | audit:read, compliance:read, blockchain:read, security:scan |
| trader | blockchain:read, payment:check, payment:execute, audit:read |
| auditor | audit:read, audit:write, compliance:read, monitor:read |
| developer | blockchain:read, security:scan, audit:read, monitor:read |
| readonly | blockchain:read, audit:read |
{
"mcpServers": {
"agentguard": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"https://feedoracle.io/guard/mcp/"
]
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
Stop letting your assistant hallucinate n8n node parameters — this server hands it the real schemas, templates and validation.
AWS Labs' official server suite — current AWS docs, CDK guidance, cost analysis and service tools.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.
kubectl with a conversational interface — inspect pods, read logs, diagnose clusters and manage workloads.