AgentsID Guard
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GUARD_CWD | No | Working directory (default: cwd) | cwd |
| GUARD_DB_URL | No | Database connection string for db_query (postgresql://, mysql://, or .db path) | |
| GUARD_TIMEOUT | No | Command timeout in ms (default: 30000) | 30000 |
| AGENTSID_BASE_URL | No | API URL (default: https://agentsid.dev) | https://agentsid.dev |
| GUARD_ALLOWED_DIRS | No | Comma-separated allowed directories for file ops (default: cwd) | cwd |
| AGENTSID_AGENT_TOKEN | Yes | Agent token for permission checks | |
| AGENTSID_PROJECT_KEY | Yes | Your AgentsID project key |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| shell_runA | Run a shell command. Validated against AgentsID permissions. Read commands (ls, cat, grep) typically allowed. Destructive commands (rm, chmod) blocked unless permitted. |
| file_readA | Read a file's contents. Restricted to allowed directories. Requires file.read permission. |
| file_writeA | Write content to a file. Creates parent directories if needed. Requires file.write permission. |
| file_deleteA | Delete a file. Requires file.delete permission. |
| file_listA | List files in a directory with size and type info. Requires file.list permission. |
| file_infoA | Get file metadata (size, type, permissions, timestamps). Requires file.info permission. |
| db_queryA | Run a SQL query. SELECT/SHOW requires db.read. INSERT/UPDATE requires db.write.. DELETE/DROP requires db.danger.. Supports PostgreSQL, MySQL, SQLite. |
| git_runA | Run a git command. Read operations (status, log, diff) require git.read.. Write operations (commit, push) require git.write.. |
| http_requestB | Make an HTTP request. GET requires http.get. POST requires http.post. PUT requires http.put. DELETE requires http.delete. |
| env_listA | List environment variables (secrets auto-filtered). Requires env.read permission. |
| env_getA | Get a specific environment variable. Secret-named vars (KEY, TOKEN, PASSWORD) require env.read.secret permission. |
| env_setA | Set an environment variable. Requires env.write permission. |
| process_listA | List running processes sorted by CPU usage. Requires process.read permission. |
| process_infoA | Get detailed info about a specific process. Requires process.read permission. |
| process_killA | Send a signal to a process. Requires process.kill permission. |
| cron_listA | List current user's cron jobs. Requires cron.read permission. |
| cron_addA | Add a cron job. Requires cron.write permission. |
| cron_removeA | Remove cron jobs matching a pattern. Requires cron.danger permission. |
| container_listA | List Docker containers. Requires container.read permission. |
| container_inspectA | Get detailed info about a Docker container. Requires container.read permission. |
| container_logsB | View Docker container logs. Requires container.read permission. |
| container_startA | Start a stopped Docker container. Requires container.write permission. |
| container_stopA | Stop a running Docker container. Requires container.write permission. |
| container_removeA | Remove a Docker container. Requires container.danger permission. |
| network_pingA | Ping a host. Requires network.read permission. |
| network_portsA | List listening network ports. Requires network.read permission. |
| network_tracerouteA | Traceroute to a host. Requires network.read permission. |
| network_dnsA | DNS lookup for a domain. Requires network.read permission. |
| system_infoA | Get system overview: OS, CPU, memory, disk, uptime. Requires system.read. |
| disk_usageB | Get disk usage for a path. Requires system.read. |
| memory_usageB | Get memory usage breakdown. Requires system.read. |
| log_readB | Read last N lines of a log file. Requires log.read. |
| log_searchB | Search a log file for a pattern. Requires log.read. |
| ssh_runA | Run a command on a remote host via SSH. Permission scoped per host (ssh.hostname). Requires SSH keys configured. |
| package_listA | List installed packages. Requires package.read. |
| package_infoC | Get info about a package. Requires package.read. |
| package_installB | Install a package. Requires package.danger.install (high risk). |
| aws_runA | Run an AWS CLI command. Read ops (ls, describe) require aws.read.{service}. Write ops require aws.write.{service}. Destructive ops (delete, terminate) require aws.danger.{service}. |
| kubectl_runA | Run a kubectl command. Read ops (get, describe, logs) require k8s.read.. Write ops (apply, create) require k8s.write.. Destructive ops (delete, drain) require k8s.danger.*. |
| secrets_storeA | Store a secret in the encrypted vault. Per-secret derived encryption keys. Requires secrets.write. |
| secrets_listA | List secret names (values never exposed). Requires secrets.read. |
| secrets_deleteB | Delete a secret from the vault. Requires secrets.danger. |
| secrets_scopeA | Restrict which tools can use a secret. E.g., scope an API key to only http.post calls. Requires secrets.write. |
| secrets_expireA | Set a time-to-live on a secret. After expiry, proxy injection will refuse to use it. Requires secrets.write. |
| secrets_injectA | Make an HTTP request with vault secrets injected server-side. The agent NEVER sees the raw secret — Guard substitutes placeholders like {{API_KEY}} with the real value, makes the call, and scrubs secrets from the response. Requires secrets.proxy. |
| secrets_auditA | View access log for secrets — who accessed what, when, for what purpose. Requires secrets.read. |
| secrets_historyB | View rotation history for a secret. Requires secrets.read. |
| secrets_anomaliesA | Detect vault anomalies: expired secrets, broad scopes, stale keys, unusual access patterns. Requires secrets.read. |
| check_permissionA | Check if a tool/action would be allowed without executing it. |
| list_categoriesA | List all permission categories and what they control. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 50 tools
Most tools are clearly separated by domain and action, but several run commands (shell, git, aws, kubectl, ssh) could be confused. Descriptions help by scoping each to a specific system, but the overlapping purpose makes misselection possible.
All tool names are lowercase with underscores and consistently use a domain prefix plus a noun or verb (e.g., file_read, env_list, secrets_delete). The pattern is highly predictable and uniform across the set.
With 50 tools, the server is heavy and covers many distinct subsystems. While each tool has a purpose, the count exceeds typical MCP server scopes and may overwhelm agents with too many options.
The tool set provides broad lifecycle coverage for secrets, files, processes, containers, and more. Minor gaps exist (e.g., no explicit update for cron jobs), but agents can work around them without dead ends.