agentguard
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AGENTGUARD_HOME | No | Signing key and decision-ledger directory | ~/.agentguard |
| AGENTGUARD_MCP_LEDGER | No | Persist signed decisions; `memory` restores process-only storage | ndjson |
| AGENTGUARD_MCP_TENANT | No | Tenant scope stamped into receipts | mcp-local |
| AGENTGUARD_ACTOR_DIGEST | No | Set to `1` to store SHA-256 digests of actor IDs; provider stays readable | |
| AGENTGUARD_MCP_DAILY_CAP_CENTS | No | Hard per-day spend cap (block on exceed) | 500 |
| AGENTGUARD_MCP_PER_CALL_CAP_CENTS | No | Hard per-call spend cap (block on exceed) | 100 |
| AGENTGUARD_MCP_DISABLE_COST_OVERRIDE | No | Set to `1` to discard and prevent pricing overrides |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| spend_decideA | Gate a model call BEFORE it runs. Pass metadata only (model, token counts, endpoint URL), never prompt content. Returns allow/block plus an Ed25519-signed, content-free receipt with model and hosting provenance (weights origin, jurisdiction, retention). Unknown self-hosted models need set_model_cost first (fail-closed). Optional agent_id, task_id and workflow_id accept identifiers only; spend_decide binds them into the signed actor. Read-only and cost-configuration tools accept these fields without recording a spend decision. |
| verify_receiptA | Independently verify an AgentGuard signed receipt. Returns valid true/false. Tampering with any signed field makes verification fail. Optional agent_id, task_id and workflow_id accept identifiers only; spend_decide binds them into the signed actor. Read-only and cost-configuration tools accept these fields without recording a spend decision. |
| export_receiptsA | Export the tenant decision ledger, including earlier process runs, as a hash-chained array of signed receipts with a chain verification result. Memory mode exports this process only. Optional agent_id, task_id and workflow_id accept identifiers only; spend_decide binds them into the signed actor. Read-only and cost-configuration tools accept these fields without recording a spend decision. |
| set_model_costA | Register a cost for a model with no built-in pricing (required for self-hosted models: AgentGuard fails closed on unknown costs). Cents per 1,000 tokens. Optional agent_id, task_id and workflow_id accept identifiers only; spend_decide binds them into the signed actor. Read-only and cost-configuration tools accept these fields without recording a spend decision. |
| provenance_previewA | Preview the provenance AgentGuard would attest for a model and endpoint WITHOUT spending: model identity, weights origin country (China-origin families flagged), hosting jurisdiction, retention posture. Optional agent_id, task_id and workflow_id accept identifiers only; spend_decide binds them into the signed actor. Read-only and cost-configuration tools accept these fields without recording a spend decision. |
| spend_statusA | Show the active policy: caps, tenant, enforcement mode, decisions so far this session, and the signer identity. Optional agent_id, task_id and workflow_id accept identifiers only; spend_decide binds them into the signed actor. Read-only and cost-configuration tools accept these fields without recording a spend decision. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 6 tools
Each tool has a distinct function: preview, status, export, set cost, decide, and verify. The repeated optional identifier language adds some textual similarity, but the core purposes are clearly separate, with only mild potential overlap between preview and status.
All tool names follow a consistent verb_noun pattern in snake_case (provenance_preview, spend_status, export_receipts, set_model_cost, spend_decide, verify_receipt). The verbs are descriptive and the nouns align with the API's domain, making the naming pattern highly predictable.
With 6 tools, the server is well-scoped. Each tool serves a distinct role in the spend-gating and receipt lifecycle, and none feel redundant or missing a critical counterpart. This is an appropriate count for a focused security/attestation service.
The tool set covers the core workflow: previewing provenance, checking status, setting model costs, making decisions, exporting receipts, and verifying them. Missing is a tool to modify policy (caps, enforcement mode), which is only exposed read-only via spend_status. This is a minor gap that an agent could work around if policies are managed externally.