agent-safety-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| cost_guard_configureA | Configure the cost guard budget. Args: weekly_budget_usd: Maximum spend per week in USD. alert_at_pct: Warn when spend reaches this percentage (0.0-1.0). dry_run: If true, all calls raise BudgetExceededError (safe for testing). |
| cost_guard_statusA | Check current budget spend — how much is left, percentage used, call details. |
| cost_guard_checkA | Pre-check if a model call is within budget. Returns safe/blocked status. Args: model: Model identifier (e.g. "anthropic/claude-haiku-4-5-20251001", "openai/gpt-4o"). estimated_input_tokens: Expected input token count. estimated_output_tokens: Expected output token count. |
| cost_guard_recordA | Record a completed LLM call's token usage and cost. Args: model: Model identifier used for the call. input_tokens: Actual input tokens consumed. output_tokens: Actual output tokens consumed. purpose: Optional label for this call (e.g. "summarizer", "classifier"). |
| cost_guard_modelsA | List all supported models with their per-token pricing. |
| injection_scanA | Scan text for prompt injection patterns. Returns risk assessment without blocking. Args: text: The text to scan for injection attempts. threshold: Sensitivity level — "LOW", "MEDIUM", "HIGH", or "CRITICAL". |
| injection_checkB | Scan text and block if injection is detected above threshold. Args: text: The text to check for injection attempts. threshold: Block at this severity or above — "LOW", "MEDIUM", "HIGH", "CRITICAL". |
| injection_patternsA | List all built-in injection detection patterns with categories and weights. |
| trace_startA | Start a new trace session for an AI agent. Args: agent: Agent name (used in filenames). trace_dir: Directory to save trace files. model: Optional model name to attach as metadata. |
| trace_stepA | Log a decision step in the current trace session. Args: name: Step name (e.g. "analyze_signal", "classify_intent"). decision: What the agent decided. confidence: Confidence score (0.0-1.0). input_data: What the agent saw (brief description). reason: Why this decision was made. outcome: "ok" or "error". |
| trace_summaryB | Get a summary of the current trace session — step count, errors, timing. |
| trace_saveA | Save the current trace to disk as JSON and Markdown files. |
| kya_generate_keypairA | Generate an Ed25519 keypair for signing agent identity cards. Args: name: Key name (default "mcp-session"). Keys stored at ~/.kya/keys/ |
| kya_create_cardB | Create a KYA (Know Your Agent) identity card for an agent. Args: agent_id: Unique ID in format "org/agent-name" (e.g. "luciferforge/research-bot"). name: Human-readable agent name. purpose: What this agent does (min 10 chars for validity). capabilities: Comma-separated list of capabilities (e.g. "text_generation,web_search"). owner_name: Owner/organization name. version: Agent version string. |
| kya_sign_cardA | Sign an existing KYA card with the session's Ed25519 private key. Args: agent_id: The agent_id of the card to sign. Must call kya_create_card first. |
| kya_verify_cardA | Verify a KYA identity card — check structure, completeness, and signature. Args: agent_id: Look up a card created in this session by agent_id. card_json: Or pass raw card JSON to verify an external card. |
| safety_checkA | Run a unified safety check: injection scan + cost check + trace step. This is the recommended single tool for pre-flight safety. It runs injection scanning, checks the cost budget, and logs the decision. Args: text: The input text to scan for injections. model: Model identifier for cost checking (optional). estimated_input_tokens: Expected input tokens for cost check. estimated_output_tokens: Expected output tokens for cost check. step_name: Name for the trace step. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 17 tools
Most tools have distinct purposes with clear boundaries between cost management, injection detection, KYA identity, and tracing domains. However, injection_check and injection_scan have overlapping functionality (both scan text for injections), which could cause confusion despite different blocking behaviors. The other tools are well-differentiated within their respective domains.
Tool names follow highly consistent snake_case patterns with clear domain prefixes: cost_guard_*, injection_*, kya_*, trace_*, and safety_check. Each tool name clearly indicates its domain and function, with no mixing of conventions or inconsistent verb styles across the set.
17 tools is slightly high but reasonable for covering multiple safety domains (cost, injection, identity, tracing). The count feels comprehensive rather than excessive, though some consolidation might improve coherence. Each domain has an appropriate number of tools for its scope.
The tool set provides complete coverage for agent safety workflows: cost management (configure, check, record, status), injection detection (check, scan, patterns), KYA identity (create, sign, verify, key generation), and tracing (start, step, summary, save). The safety_check tool even provides unified coverage, and there are no obvious gaps in the safety lifecycle.