Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@agentguard-mcp Check if https://api.openai.com is allowed under my policy."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server for @mukundakatta/agentguard. Lets Claude Desktop, Cursor, Cline, Windsurf, Zed, or any other MCP client check whether a URL is allowed under a network-egress policy before any fetch.
npx -y @mukundakatta/agentguard-mcpThree tools:
check_url — single URL check: returns { allowed, reason } without making any actual request.
check_urls_batch — batch check with per-URL decisions plus a summary.
validate_policy — sanity-check a policy spec for empty allowlists, overly broad * wildcards, and malformed host patterns.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"agentguard": {
"command": "npx",
"args": ["-y", "@mukundakatta/agentguard-mcp"]
}
}
}Same shape for Cursor (~/.cursor/mcp.json), Cline, Windsurf, Zed.
Related MCP server: url-ai-mcp
check_url:
{
"url": "https://api.openai.com/v1/chat",
"policy": { "allow": ["api.openai.com", "*.anthropic.com"] }
}Returns:
{ "allowed": true, "reason": "matched_allowlist", "detail": null }check_urls_batch:
{
"urls": [
"https://api.openai.com/v1/chat",
"https://evil.example.com/leak"
],
"policy": { "allow": ["api.openai.com"] }
}Returns:
{
"results": [
{ "url": "https://api.openai.com/v1/chat", "allowed": true, ... },
{ "url": "https://evil.example.com/leak", "allowed": false, "reason": "not_in_allowlist", ... }
],
"summary": { "total": 2, "allowed_count": 1, "denied_count": 1 }
}validate_policy:
{ "policy": { "allow": ["*", "https://api.example.com", "api.example.com/v1"] } }Returns issues for the * wildcard, the scheme prefix, and the path suffix — common mistakes when first writing a policy.
@mukundakatta/agentguard is a zero-dependency JavaScript library. This MCP server makes its decision engine accessible from any MCP-aware AI assistant: ask Claude "does my agent's tool list pass this firewall?" or "which of these 50 URLs would my policy block?" and the assistant calls these tools directly.
Note: this MCP server only checks URLs — it does not actually wrap fetch or block real requests. For runtime enforcement, use @mukundakatta/agentguard directly inside your Node process.
Part of the agent-stack series:
@mukundakatta/agentfit-mcp — Fit it.
@mukundakatta/agentguard-mcp — Sandbox it. (this)
@mukundakatta/agentsnap-mcp — Test it.
@mukundakatta/agentvet-mcp — Vet it.
@mukundakatta/agentcast-mcp — Validate it.
MIT
Check whether a URL is allowed under a network policy. Returns { allowed, reason } without making any actual request. Use this to gate tool calls before they execute.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL to check. | |
| method | No | HTTP method (default GET). | |
| policy | Yes | A simplified network policy. Use { allow: ["api.openai.com", "*.example.com"] }. Optional: deny: string[], methods: string[]. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full burden. It states the tool returns { allowed, reason } without making an actual request, disclosing its read-only safety profile. No additional behavioral traits are needed for this simple check.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. It front-loades the purpose and immediately describes the output and non-request behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has a nested object parameter but no output schema. The description compensates by explaining the output shape and use case, making it complete for an agent to understand and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage; all three parameters (url, method, policy) are described in the schema. The description does not add further meaning beyond what the schema provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks a URL against a network policy, returns an allowed/reason object, and does so without making a request. It distinguishes itself from siblings like check_urls_batch (batch) and validate_policy (policy validation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this to gate tool calls before they execute,' providing clear usage context. It does not explicitly state when not to use or name alternatives, but the sibling list implies batch and validation alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Batch-check multiple URLs against the same policy. Returns per-URL decisions plus an allowed/denied summary. Useful for vetting a list of pending tool fetches.
| Name | Required | Description | Default |
|---|---|---|---|
| urls | Yes | URLs to check. | |
| method | No | HTTP method applied to all URLs. | |
| policy | Yes | A simplified network policy. Use { allow: ["api.openai.com", "*.example.com"] }. Optional: deny: string[], methods: string[]. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description states the tool returns per-URL decisions and a summary, implying a read-only operation. But without annotations, it does not explicitly confirm idempotency, error handling, or if any state changes occur.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that front-load the purpose and output, then provide a use case. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description adequately describes the return value. It covers the tool's purpose, usage context, and basics of output, but lacks detail on nested policy structure and potential errors.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the description adds value by explaining batch behavior ('same policy') and output structure ('allowed/denied summary'), going beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb and resource: 'Batch-check multiple URLs against the same policy.' It also distinguishes from siblings (check_url, validate_policy) by specifying batch operation and policy application.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides a concrete use case: 'Useful for vetting a list of pending tool fetches.' However, it does not explicitly mention when to use alternatives like check_url for single URL checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Sanity-check a policy spec without making any decision. Catches: empty allow list, overly broad "*" wildcards, malformed host patterns containing schemes/paths/queries.
| Name | Required | Description | Default |
|---|---|---|---|
| policy | Yes | A simplified network policy. Use { allow: ["api.openai.com", "*.example.com"] }. Optional: deny: string[], methods: string[]. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool does not make decisions (only sanity-checks) and lists specific validation behaviors. However, it lacks details on side effects, permissions, or rate limits. With no annotations, the description carries the burden but provides some transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the main action, and no extraneous words. It is concise, though a bullet list might improve scanability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's purpose but does not mention the return format (e.g., boolean, list of errors). Since there is no output schema, the description should indicate what the output looks like for an agent to handle results properly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of the parameters with detailed descriptions. The description adds meaning beyond the schema by specifying the validation logic (catches empty allow list, etc.), which helps the agent understand tool behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action (sanity-check a policy spec) and resource (policy spec). It lists specific validation catches (empty allow list, overly broad wildcards, malformed host patterns), which distinguishes it from siblings like check_url and check_urls_batch.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies it is a validation-only tool ('without making any decision') and lists what it catches, but does not explicitly compare to siblings or state when to use it over check_url/check_urls_batch. Guidance is inferred but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0check_urlcheck_urls_batchvalidate_policyEach tool has a clearly distinct purpose: single URL check, batch URL check, and policy validation. No overlap or ambiguity.
All tools use snake_case and a clear verb_noun pattern. 'check_urls_batch' slightly deviates by appending 'batch' as a suffix, but is still understandable and consistent in style.
With 3 tools, the server is well-scoped for its purpose of URL checking and policy validation. Each tool serves a necessary function without excess.
The tool set covers the core use cases: checking individual or multiple URLs, and validating policy specs. It lacks policy management tools (create/update/delete), but that may be out of scope for a 'checker' server.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Git-native policy layer for AI agents: check_action verdicts against rules approved via PR.
Generate, audit, and maintain legal policies that match what your code actually does.
Deterministic allow/require_approval/deny verdicts for agent actions, before they happen.
Ask before you fetch: will this domain serve your crawler, refuse it, or charge it?
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/MukundaKatta/agentguard-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
