How do I install AgentGuard?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does AgentGuard need an API key?

The publisher lists these environment variables: AGENTGUARD_MCP_DAILY_CAP_CENTS, AGENTGUARD_MCP_PER_CALL_CAP_CENTS, AGENTGUARD_MCP_TENANT, AGENTGUARD_HOME, AGENTGUARD_MCP_LEDGER, AGENTGUARD_MCP_DISABLE_COST_OVERRIDE, AGENTGUARD_LOCK_COST_OVERRIDES, AGENTGUARD_ACTOR_DIGEST, AGENTGUARD_LICENSE_KEY, AGENTGUARD_LICENSE_ENDPOINT, AGENTGUARD_NO_BEACON, AGENTGUARD_TELEMETRY, AGENTGUARD_INSTALL_ID, AGENTGUARD_ANONYMOUS_INSTALL_ID, CI, GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, BUILDKITE, VERCEL, NETLIFY.

What transport does AgentGuard use?

AgentGuard runs locally over stdio.

AgentGuard

Q: When was AgentGuard last checked?

Last checked 2026-10-16. Local spend caps, kill-switch blocking and Ed25519-signed receipts for AI agent tool calls.

by io.github.MerchantGuard

Local spend caps, kill-switch blocking and Ed25519-signed receipts for AI agent tool calls.

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Local command

npx -y @agentguard-run/[email protected]

Credentials from the publisher

AGENTGUARD_MCP_DAILY_CAP_CENTS — Local daily spend cap in cents. A nonnegative integer.
AGENTGUARD_MCP_PER_CALL_CAP_CENTS — Local per-call spend cap in cents. A nonnegative integer.
AGENTGUARD_MCP_TENANT — Tenant identifier stamped into local receipts.
AGENTGUARD_HOME — Local signing-key, configuration and ledger directory. Defaults to .agentguard in the operating system home directory.
AGENTGUARD_MCP_LEDGER — Local decision storage. ndjson persists receipts across restarts; memory retains this process only.
AGENTGUARD_MCP_DISABLE_COST_OVERRIDE — Set to 1 to discard and prevent model pricing overrides for this server.
AGENTGUARD_LOCK_COST_OVERRIDES — Spend SDK startup lock. Set to 1 to prevent model pricing overrides.
AGENTGUARD_ACTOR_DIGEST — Set to 1 to hash actor identifiers before they enter local receipts.
AGENTGUARD_LICENSE_KEY — Optional AgentGuard license key for license validation and seat registration. Otherwise read from local configuration.
AGENTGUARD_LICENSE_ENDPOINT — License and seat service base URL. No prompts, tool content or receipts are sent.
AGENTGUARD_NO_BEACON — Set to 1 to disable optional activation telemetry regardless of saved consent.
AGENTGUARD_TELEMETRY — Set to 1 to opt in to content-free activation telemetry. Otherwise saved consent applies, default off.
AGENTGUARD_INSTALL_ID — Optional identifier used only by opted-in activation telemetry when no saved install identifier exists.
AGENTGUARD_ANONYMOUS_INSTALL_ID — Legacy fallback for AGENTGUARD_INSTALL_ID in opted-in activation telemetry.
CI — Existing runtime marker. A nonempty value marks opted-in activation telemetry as CI; it does not enable telemetry.
GITHUB_ACTIONS — Existing runtime marker. A nonempty value marks opted-in activation telemetry as CI; it does not enable telemetry.
GITLAB_CI — Existing runtime marker. A nonempty value marks opted-in activation telemetry as CI; it does not enable telemetry.
CIRCLECI — Existing runtime marker. A nonempty value marks opted-in activation telemetry as CI; it does not enable telemetry.
BUILDKITE — Existing runtime marker. A nonempty value marks opted-in activation telemetry as CI; it does not enable telemetry.
VERCEL — Existing runtime marker. A nonempty value marks opted-in activation telemetry as CI; it does not enable telemetry.
NETLIFY — Existing runtime marker. A nonempty value marks opted-in activation telemetry as CI; it does not enable telemetry.

Provider

Claude Code

AGENTGUARD_MCP_DAILY_CAP_CENTS=<value> AGENTGUARD_MCP_PER_CALL_CAP_CENTS=<value> AGENTGUARD_MCP_TENANT=<value> AGENTGUARD_HOME=<value> AGENTGUARD_MCP_LEDGER=<value> AGENTGUARD_MCP_DISABLE_COST_OVERRIDE=<value> AGENTGUARD_LOCK_COST_OVERRIDES=<value> AGENTGUARD_ACTOR_DIGEST=<value> AGENTGUARD_LICENSE_KEY=<secret> AGENTGUARD_LICENSE_ENDPOINT=<value> AGENTGUARD_NO_BEACON=<value> AGENTGUARD_TELEMETRY=<value> AGENTGUARD_INSTALL_ID=<value> AGENTGUARD_ANONYMOUS_INSTALL_ID=<value> CI=<value> GITHUB_ACTIONS=<value> GITLAB_CI=<value> CIRCLECI=<value> BUILDKITE=<value> VERCEL=<value> NETLIFY=<value> claude mcp add io.github.merchantguard-agentguard -- npx -y @agentguard-run/[email protected]

Run in a terminal.

Claude Desktop

{
  "mcpServers": {
    "io.github.merchantguard-agentguard": {
      "command": "npx",
      "args": [
        "-y",
        "@agentguard-run/[email protected]"
      ],
      "env": {
        "AGENTGUARD_MCP_DAILY_CAP_CENTS": "<value>",
        "AGENTGUARD_MCP_PER_CALL_CAP_CENTS": "<value>",
        "AGENTGUARD_MCP_TENANT": "<value>",
        "AGENTGUARD_HOME": "<value>",
        "AGENTGUARD_MCP_LEDGER": "<value>",
        "AGENTGUARD_MCP_DISABLE_COST_OVERRIDE": "<value>",
        "AGENTGUARD_LOCK_COST_OVERRIDES": "<value>",
        "AGENTGUARD_ACTOR_DIGEST": "<value>",
        "AGENTGUARD_LICENSE_KEY": "<secret>",
        "AGENTGUARD_LICENSE_ENDPOINT": "<value>",
        "AGENTGUARD_NO_BEACON": "<value>",
        "AGENTGUARD_TELEMETRY": "<value>",
        "AGENTGUARD_INSTALL_ID": "<value>",
        "AGENTGUARD_ANONYMOUS_INSTALL_ID": "<value>",
        "CI": "<value>",
        "GITHUB_ACTIONS": "<value>",
        "GITLAB_CI": "<value>",
        "CIRCLECI": "<value>",
        "BUILDKITE": "<value>",
        "VERCEL": "<value>",
        "NETLIFY": "<value>"
      }
    }
  }
}

claude_desktop_config.json

Step-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Related MCP

Related skills

View all

@agentguard-run/mcp

AgentGuard® as an MCP server: local spend caps and Ed25519-signed provenance receipts for AI agent actions, usable from any Model Context Protocol host (Claude Desktop, Claude Code, Cursor, Cline, or your own agent runtime).

Zero data plane. Tools accept metadata only: model names, token counts, endpoint URLs. Prompts and completions never pass through this server, and their content stays on your machine. Receipts are content-free.

A configured license uses the license and seat service. Optional activation telemetry requires consent and can be disabled with AGENTGUARD_NO_BEACON=1. Neither path sends prompts, tool content or receipts.

Install

{
  "mcpServers": {
    "agentguard": {
      "command": "npx",
      "args": ["-y", "@agentguard-run/mcp"]
    }
  }
}

Optional environment variables:

Variable	Default	Meaning
`AGENTGUARD_MCP_DAILY_CAP_CENTS`	`500`	Hard per-day spend cap (block on exceed)
`AGENTGUARD_MCP_PER_CALL_CAP_CENTS`	`100`	Hard per-call spend cap (block on exceed)
`AGENTGUARD_MCP_TENANT`	`mcp-local`	Tenant scope stamped into receipts
`AGENTGUARD_HOME`	`~/.agentguard`	Signing key and decision-ledger directory
`AGENTGUARD_MCP_LEDGER`	`ndjson`	Persist signed decisions; `memory` restores process-only storage
`AGENTGUARD_MCP_DISABLE_COST_OVERRIDE`	unset	`1` discards and prevents pricing overrides
`AGENTGUARD_ACTOR_DIGEST`	unset	`1` stores SHA-256 digests of actor IDs; provider stays readable

A signing keypair is generated on first run and persisted to <AGENTGUARD_HOME>/mcp-signing.json (0600). Signed decisions are appended to <AGENTGUARD_HOME>/<tenant>/decisions.ndjson, including the public verification key. Exports include prior process runs and new decisions extend the existing chain. Tenant directory names use the spend store's filename normalization. Spend counters remain process-local, as in earlier versions.

All tools accept optional agent_id, task_id, and workflow_id identifier parameters. spend_decide passes these to the call context, signing them as actor.agentId, actor.taskId, and actor.workflowId; the configured tenant becomes actor.tenantId. Other tools accept these metadata fields without recording a spend decision. Prompts, arbitrary content, credentials, and filesystem paths are rejected as IDs. Existing calls without these parameters keep working.

Tools

spend_decide: gate a model call before it runs. Returns allow/block plus a signed, hash-chained receipt recording model identity, weights origin country (China-origin families such as GLM, DeepSeek, Qwen, and Kimi are flagged automatically), hosting jurisdiction, and retention posture. Unrecognized endpoints (vLLM, Ollama, TGI, your own cluster) route as self-hosted: zero retention, your jurisdiction.
verify_receipt: independently verify any receipt. Change one signed byte and verification fails.
export_receipts: export the tenant decision ledger as a verified hash chain, including earlier process runs. Memory mode exports only the current process.
set_model_cost: register pricing for self-hosted models (AgentGuard fails closed on unknown costs).
provenance_preview: see what would be attested for a model/endpoint without spending.
spend_status: active caps, tenant, decision count, signer fingerprint.

Why

When agents move from hosted APIs to self-hosted models, the provider's spend dashboard, rate limits, and audit logs disappear with the provider. AgentGuard puts them back, locally, and adds something hosted providers never gave you: a cryptographic receipt an outsider can verify without trusting you or us.

More: https://agentguard.run/sovereign/ and https://agentguard.run/sovereign/guide/

Verify independently

Any receipt can be checked off-platform at https://agentguard.run/verify or with verify_receipt and the signer public key from spend_status.

Local release verification

Requires Node.js 20.19 or later. Run npm ci, npm test, and npm run scan:release from this package or its public mirror. The lockfile uses the published spend 0.19.0 package; no private sibling checkout is required.

Release checklist: keep package.json, the server version in src/index.ts, and both versions in server.json aligned; run the tests and release scan; publish npm first, publish with mcp-publisher, then verify the registry's active entry. See the registry release guide for exact commands and the public mirror allowlist.

The official registry name is io.github.MerchantGuard/agentguard. Its package entry runs @agentguard-run/mcp locally through npx and stdio.

AgentGuard® is a registered trademark of Dunecrest Ventures Inc. US patent filings pending. This package is governance software, not legal or compliance advice.