AgentGuard MCP

AgentGuard MCP is a security gateway for the Model Context Protocol that acts as the managed boundary between AI agents and the tools and MCP servers they call. It inspects every tool request and response inline, detecting and blocking PII and secrets before they can flow downstream or off-system — so sensitive data never leaves your environment. The result is a 99.9% data-protection posture without changing how developers build agent workflows.

The Problem

AI agents like Claude Code, Cursor, and custom internal agents increasingly call out to external tools and MCP servers — filesystems, databases, HTTP APIs, and third-party MCP services. Every one of those calls is a trust-boundary crossing, and the MCP layer itself applies no inline data inspection. A tool that reads a log file, queries a database, or posts to an external API can quietly carry SSNs, credit-card numbers, PHI, API keys, and bearer tokens straight through the agent and out of the environment.

That is unacceptable in any regulated context, and it is especially hard to defend in federal and enterprise settings where an authorization package has to show how information flow is enforced, not merely assert that it is. The gap is not a missing feature in any single agent runtime — it is the absence of a managed boundary that every tool call must pass through, with inspection, blocking, and auditable evidence on the other side. AgentGuard exists to be that boundary.

Architecture

The gateway sits in the path between agents and their tools. Requests and responses are scanned inline — PII and DLP patterns, secrets, and prompt-injection indicators are flagged and blocked before any data crosses the boundary, and every decision is appended to an Ed25519-signed, hash-chained audit log. The agent runtime and the tools on either side are unchanged; the trust enforcement is entirely in the middle.

Approach

• Inline inspection on every call. Every tool request and response is scanned in-path for PII (SSN, credit-card, and PHI patterns) and secret material, blocking matches before they can flow downstream or off-system. The scan happens at the boundary, not after the fact — so a 99.9% data-protection posture is enforced structurally rather than promised in a policy document.
• Federal Mode is deny-by-default. Federal Mode flips the model from allow-by-default to deny-by-default, with full PII and prompt-injection scanning applied to every call. Tools only execute if they are explicitly permitted, which is the only posture that survives an ATO review.
• Tamper-evident, hash-chained audit. Every inspection decision — allow, block, reason — is written as an audit event that is Ed25519-signed and hash-chained to the previous event. The log is reconstructable and non-repudiable: you can prove what was blocked, when, and that the chain has not been altered.
• Compliance evidence on demand. Federal Mode generates FedRAMP 20x and OSCAL evidence reports directly from the audit log, so the artifacts an assessor asks for fall out of normal operation instead of a separate collection exercise.
• Native control-framework mappings. The gateway maps directly to NIST 800-53 Rev 5.2 (AC-4 information-flow enforcement, SI-10/SI-15 input and output filtering), NIST AI 600-1, the OWASP LLM Top 10 (2025), and MITRE ATLAS. The controls an organization already operates against are the controls AgentGuard is measured on, so it slots into an existing authorization package rather than inventing a new taxonomy.

Outcomes

AgentGuard ships in two modes that cover the same boundary at different assurance levels: a developer-friendly Dev mode for day-to-day agent work, and a deny-by-default Federal mode for regulated and agency environments. In both, sensitive data is caught inline before it can leave the system, every decision is cryptographically auditable, and the evidence an assessor needs is generated from the same stream that does the enforcement. The hard numbers — 99.9% data-protection posture, inline blocking of PII and secrets, Ed25519-signed audit events, and coverage across four control frameworks — are captured in the metrics above.