Skip to content
PERMISSION/PROTOCOL

MCP Guard · Open source

Set the rules for your agent’s tool calls.

Evaluate routed MCP calls before they reach the server. Choose what passes, what is blocked, and what needs a human decision.

Review setup Walk through an approval

Connect one workflow, then verify it.

  1. 01

    Choose the server path

    Use a stdio MCP server you can launch through the proxy. Update the client configuration so calls use that path.

  2. 02

    Define and observe the rules

    Match tool names and arguments to allow, block, or require approval. Observe mode logs decisions while forwarding calls.

  3. 03

    Enable approval and test enforcement

    Enable the local approval UI for held calls. Switch to enforce mode and test allowed, blocked, approved, denied, and timed-out calls.

npm install @permission-protocol/mcp-guardnpx mcp-guard --config pp.config.yaml --mode observe -- node my-mcp-server.js# After reviewing your rules, enable enforcement and the local approval UI:npx mcp-guard --config pp.config.yaml --mode enforce --approval-port 3100 -- node my-mcp-server.js

Replace the example server command and tool names with your own. Review your package version’s setup instructions before running it.

Read the source and setup guide

What this controls, and what it doesn’t.

  • Only calls routed through the proxy are evaluated. Direct credentials and other tool paths remain outside it.
  • Observe mode does not block. Without the approval UI, a require-approval rule returns a hold error rather than opening an approval session.
  • Local JSONL decision records include payload hashes. A hash alone is not a cryptographic signature or independent proof of human authorization.
  • Confirm the transport, package version, record fields, and signing requirements for your deployment.

Decide what evidence you need.

Match the record format to your review requirements. If you need independently signed human-approval evidence, confirm that requirement and the signing integration before rollout.

From approval to receipt Discuss your workflow

Ready to test your first workflow?

Work through setup, approval, denial, and evidence inspection. Keep track of your checks before expanding the rollout.

Open the test checklist