# io.tooloracle/agentguard (remote · feedoracle.io)

AgentGuard — 20-tool AI safety MCP: policy preflight, risk scoring, audit logging, rate limits.

- Trust score: 61/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `feedoracle.io`: 61/100 (this document), [markdown](https://verifymcp.io/servers/io-tooloracle-agentguard/guard-oracle-mcp.md), [page](https://verifymcp.io/servers/io-tooloracle-agentguard/guard-oracle-mcp)

## Channel facts

- Endpoint: `https://feedoracle.io/guard-oracle/mcp/`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 24 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2510 tokens (~104/item across 24 items; 24 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 93/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 80% of tool parameters carry a description.
- **Capabilities**: 40/100
  - Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http io-tooloracle-agentguard https://feedoracle.io/guard-oracle/mcp/
```

### Codex

```toml
[mcp_servers.io-tooloracle-agentguard]
url = "https://feedoracle.io/guard-oracle/mcp/"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-tooloracle-agentguard": {
      "type": "remote",
      "url": "https://feedoracle.io/guard-oracle/mcp/",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-tooloracle-agentguard --url https://feedoracle.io/guard-oracle/mcp/ --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-tooloracle-agentguard:
    url: "https://feedoracle.io/guard-oracle/mcp/"
```

### Other

```json
{
  "mcpServers": {
    "io-tooloracle-agentguard": {
      "type": "http",
      "url": "https://feedoracle.io/guard-oracle/mcp/"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 61, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 60, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 59, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 59, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 58, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 57)

First indexed and scored.

## MCP tools (24)

### `policy_preflight` (~110 tokens)

Pre-flight security check before any tool call. Evaluates all policies, computes risk score, checks rate limits, and returns allow/deny/require_approval decision. Call this BEFORE executing any agent tool. Writes to audit log automatically.

Input parameters:

- `agent_id` (string): Unique identifier for the calling agent
- `session_id` (string): Session identifier (optional)
- `tool_args` (object): Arguments for the tool call
- `tool_name` (string, required): Name of tool about to be called

### `tool_risk_score` (~104 tokens)

Compute 0-100 risk score for any tool + input combination. 0=minimal risk (read-only), 100=critical (payment/irreversible). Detects secrets, injection attempts, high-value amounts. Use before deciding whether to proceed with a tool call.

Input parameters:

- `agent_id` (string): Agent identifier (affects trust factor)
- `tool_args` (object): Tool arguments to analyze
- `tool_name` (string, required): Tool name to score

### `approval_required` (~93 tokens)

Check if a tool call requires human approval before execution. Returns requires_approval=true/false with matched policy list. Set register_pending=true to create a trackable approval request with an approval_url for human review.

Input parameters:

- `agent_id` (string): Agent identifier
- `register_pending` (boolean): Create pending approval record
- `tool_args` (object): Tool arguments
- `tool_name` (string, required): Tool to check

### `audit_log_write` (~167 tokens)

Write a tool call result to the persistent, signed audit log. Call this AFTER tool execution with the outcome. Each entry is cryptographically signed for tamper-evidence. Essential for compliance, DORA, MiCA audit trail requirements.

Input parameters:

- `agent_id` (string): Agent that made the call
- `decision` (string): allowed|denied|flagged|approved
- `duration_ms` (integer): Execution time in milliseconds
- `outcome` (string): success|error|timeout
- `reason` (string): Why this decision was made
- `risk_score` (integer): Risk score at time of call
- `session_id` (string): Session identifier
- `tool_args` (object): Arguments used
- `tool_name` (string, required): Tool that was executed

### `audit_log_query` (~154 tokens)

Query the persistent audit trail. Filter by agent, tool, decision, time range. Returns signed entries with tamper-detection. Use for compliance reporting, anomaly detection, or agent behaviour analysis.

Input parameters:

- `agent_id` (string): Filter by agent ID
- `decision` (string): Filter: allowed|denied|flagged|approved
- `limit` (integer): Max entries (default 50, max 500)
- `offset` (integer): Pagination offset
- `since` (string): ISO timestamp start (e.g. 2026-03-27T00:00:00Z)
- `tool_name` (string): Filter by tool name
- `until` (string): ISO timestamp end

### `decision_explain` (~113 tokens)

Get a human-readable explanation of why a tool call was allowed or denied. Pass request_id from a previous policy_preflight for stored explanation, or provide tool_name + tool_args for fresh analysis. Explains matched policies, risk score breakdown, and recommendation.

Input parameters:

- `agent_id` (string): Agent identifier
- `request_id` (string): request_id from previous preflight (optional)
- `tool_args` (object): Arguments to analyze
- `tool_name` (string): Tool to analyze (if no request_id)

### `rate_limit_check` (~73 tokens)

Check if an agent has exceeded rate limits. Returns per-window usage (minute/hour/day) with percentage used. Limits: 200/min, 5000/hr, 50000/day per agent. Use before high-frequency tool calls or for agent health monitoring.

Input parameters:

- `agent_id` (string, required): Agent ID to check

### `payment_policy_check` (~141 tokens)

Validate a payment against policy rules before execution. Checks amount limits (>100k warns, >1M blocks), recipient allowlist/denylist, supported currencies/networks, AML reporting thresholds, and MiCA flags. Returns approved/rejected with full violation list and risk score.

Input parameters:

- `agent_id` (string): Agent identifier
- `amount` (number, required): Payment amount
- `currency` (string): Currency code (USD, EUR, USDC, ETH...)
- `network` (string): Payment network (ethereum, base, sepa...)
- `purpose` (string): Payment purpose (required for compliance)
- `recipient` (string): Recipient address or ID

### `spend_limit_check` (~117 tokens)

Check if a payment amount stays within agent spend limits. Default limits: 10,000/call, 50,000/hr, 200,000/day. Trusted agents: 100,000/call, 500,000/hr, 2,000,000/day. Returns within_limits=true/false with headroom percentage.

Input parameters:

- `agent_id` (string): Agent identifier
- `amount` (number, required): Amount to check
- `currency` (string): Currency code
- `trust_level` (string): default or trusted

### `secret_exposure_check` (~108 tokens)

Deep scan any text/payload for secrets, credentials, and PII. Detects: API keys (OpenAI, GitHub, AWS), tokens (Slack, Bearer), private keys (ETH, Bitcoin), credentials (passwords, secrets), and PII (emails, credit cards, SSNs). Returns findings with severity and remediation guidance.

Input parameters:

- `payload` (string, required): Text or JSON string to scan
- `scan_type` (string): all | keys | tokens | pii

### `payload_safety_check` (~122 tokens)

Comprehensive safety scan for injection attacks and dangerous patterns. Detects: prompt injection, jailbreak/DAN attempts, role hijacking, SQL injection (UNION/DROP/OR 1=1), XSS, Python/JS/Shell code injection, path traversal, oversized payloads, null bytes. Returns safe=true/false with finding list and block/allow decision.

Input parameters:

- `agent_id` (string): Agent identifier
- `payload` (required): Payload to scan (string or object)
- `strict_mode` (boolean): Block on any finding (default: false)

### `replay_guard_check` (~112 tokens)

Detect replay attacks — identical requests sent multiple times in a time window. Uses SHA256 fingerprint of (agent_id + tool_name + args). Default window: 300 seconds (5 min). Returns is_replay=true/false with duplicate count and first/last seen timestamps.

Input parameters:

- `agent_id` (string): Agent identifier
- `tool_args` (object): Tool arguments (used for fingerprint)
- `tool_name` (string, required): Tool name to check
- `window_seconds` (integer): Replay window in seconds

### `cross_tool_anomaly_check` (~93 tokens)

Detect anomalous tool usage patterns across an agent recent history. Checks risky tool combinations (AML-then-payment, wallet-recon-then-transfer), high call frequency, repeated denials, broad reconnaissance, elevated risk scores.

Input parameters:

- `agent_id` (string, required): Agent to analyze
- `sensitivity` (string): low|medium|high
- `window_seconds` (integer): Lookback seconds (default 300)

### `scope_check` (~82 tokens)

Check if agent has required scope for a tool. Roles: admin, compliance_officer, trader, auditor, developer, readonly. Returns has_scope + missing scope + granting roles.

Input parameters:

- `agent_id` (string)
- `role` (string)
- `scopes` (array)
- `session_id` (string)
- `tool_name` (string, required)

### `session_validate` (~96 tokens)

Create/validate/invalidate agent sessions with role, scopes, TTL and call budget. Actions: create|validate|invalidate|info.

Input parameters:

- `action` (string, required)
- `agent_id` (string)
- `call_budget` (integer)
- `role` (string)
- `scopes` (array)
- `session_id` (string)
- `tenant_id` (string)
- `ttl_seconds` (integer)

### `tenant_policy_check` (~83 tokens)

Multi-tenant governance. Tenants: default, fintech_eu (MiCA/DORA), defi_protocol, enterprise_read. Checks tool blocklists, max risk scores, spend limits. Actions: check|list.

Input parameters:

- `action` (string)
- `agent_id` (string)
- `tenant_id` (string)
- `tool_name` (string)

### `threat_intel_check` (~91 tokens)

Check entity against threat intelligence. Auto-detects ETH addresses, IPs, domains. Checks sanctions (Tornado Cash), disposable services, behavioral analysis from audit log. Returns threat_level: none|low|medium|high|critical.

Input parameters:

- `agent_id` (string)
- `entity` (string, required): Address, IP, domain or agent_id to check
- `entity_type` (string)

### `output_safety_scan` (~120 tokens)

Post-execution output scanner. Checks tool output for PII leaks (email, phone, SSN, IBAN), secret exposure, data exfiltration patterns (outbound URLs, base64), and tool poisoning (injected instructions). Verdict: clean|warn|flag|block.

Input parameters:

- `agent_id` (string)
- `output` (string, required): Tool output text or JSON to scan
- `strict` (boolean): Block on any high-severity finding
- `tool_name` (string): Name of the tool that produced this output

### `emergency_kill` (~107 tokens)

Emergency kill-switch. Immediately terminates agent session(s), revokes pending approvals, blocks rate limits, and audit-logs the emergency. Use for: compromised agents, runaway automation, suspicious behavior. kill_type: full|session_only|soft.

Input parameters:

- `agent_id` (string): Agent to kill
- `kill_type` (string): full|session_only|soft
- `reason` (string): Why emergency kill was triggered
- `session_id` (string): Specific session to kill

### `tool_manifest_verify` (~96 tokens)

Supply-chain verification for MCP tools. Checks publisher identity against allowlist, scans tool descriptions for prompt injection, validates server domain and signing capability. Verdict: trusted|caution|block.

Input parameters:

- `publisher` (string): Claimed publisher name
- `server_url` (string): MCP server URL to verify
- `tool_description` (string): Tool description to scan for injections
- `tool_name` (string): Tool name to check

### `approval_resolve` (~96 tokens)

Resolve a pending approval request. Approve or deny a tool call that was flagged for human review. Updates agent state and creates audit trail. Requires authentication.

Input parameters:

- `approved_by` (string): Identity of the approver (name/email/agent_id)
- `decision` (string, required): Approve or deny
- `reason` (string): Optional reason for the decision
- `request_id` (string, required): The approval request ID to resolve

### `approval_list` (~92 tokens)

List approval requests. Filter by status (pending/approved/denied/all), agent_id, or tool_name. Shows summary stats.

Input parameters:

- `agent_id` (string): Filter by agent ID
- `limit` (integer): Max results (default: 50, max: 200)
- `status` (string): Filter by status (default: pending)
- `tool_name` (string): Filter by tool name

### `policy_register` (~90 tokens)

View the central policy registry. Query tiers (T1-T4), tool classifications, escalation rules. Actions: summary (default), lookup (by tool_name), tiers, rules, tools (by tier_id).

Input parameters:

- `action` (string): What to query (default: summary)
- `tier_id` (string): Tier ID for tools action
- `tool_name` (string): Tool name for lookup action

### `guard_metrics` (~50 tokens)

AgentGuard operational metrics. Returns decision stats, top agents/tools, risk distribution, daily activity, approval stats, and tier distribution.

Input parameters:

- `days` (integer): Time window in days (default: 30)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-tooloracle-agentguard/guard-oracle-mcp#diagnostics

## Score history

- 2026-08-03: 61
- 2026-08-02: 61
- 2026-08-01: 60
- 2026-07-31: 60
- 2026-07-30: 59
- 2026-07-29: 59
- 2026-07-28: 59
- 2026-07-27: 58
- 2026-07-26: 57

## Links

- Remote endpoint: https://feedoracle.io/guard-oracle/mcp/
- Repository: https://github.com/ToolOracle/agentguard
- Changelog RSS feed: https://verifymcp.io/servers/io-tooloracle-agentguard/guard-oracle-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-tooloracle-agentguard/guard-oracle-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/io-tooloracle-agentguard/guard-oracle-mcp