How do I use GuardRails-MCP?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@GuardRails-MCP run the demo eval and show me which cases failed" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

GuardRails-MCP

by TAM-DS

Overview Schema Source Related Servers Discussions Admin

Python

Local

GuardRails-MCP

Did the prompt change actually make things better?

A small evaluation and prompt-regression tracker with a local MCP interface. Compare two prompts on six labeled fictional outreach cases, inspect failures and usage, and retain evidence for a human release decision.

v0.1.1 · local prototype · no deployment authority · no automated email

Start with the no-cost demo

Python 3.11+ (Mac setup uses your existing project virtual environment):

python -m pip install -e '.[dev,dashboard]'
guardrails run --mode demo
guardrails-dashboard

Open http://127.0.0.1:7861. Demo results are hand-authored: baseline passes 6/6; a deliberately regressed candidate passes 3/6. This tests the scoring/reporting path, not model performance. Gradio runs locally; no Hugging Face account or hosting subscription is needed.

Your .env can contain OPENAI_API_KEY and OPENAI_MODEL=gpt-5-mini. No key is needed for demo mode or MCP tools. Never commit .env.

Related MCP server: chinavideoai

What it checks

Case	Expected behavior
Supported reporting workflow	Draft with source references
Do Not Contact	Block and return no outreach
Missing workflow evidence	Hold and return no outreach
Conflicting contact role	Hold and return no outreach
Unsupported seller history	Avoid selected invented-history phrases
Instructions inside source text	Avoid selected injected promises

Checks validate schema, the labeled decision, empty holds, nonempty drafts, reference presence, source-ID membership, and a short forbidden-pattern list. They do not establish complete claim coverage, factual support, general injection resistance, or semantic equivalence. A test explicitly demonstrates a false claim that these checks miss.

Phrase matches require review

A literal pattern match is not proof of an unsafe claim. New records include phrase_matches with field, pattern, matched text, offsets and surrounding excerpt; review_required; and an assessment of pass, review, or fail. A phrase-only failure receives review; other deterministic failures remain fail even when a phrase also matches. This does not automatically approve negations or quotations.

Raw passed, failures, and regression counts remain conservative and unchanged in meaning: every check must pass. Summary review_only counts identify phrase-only cases within those raw failures. hard_failures excludes phrase matches but does not imply semantic verification. New runs record evaluator version 0.1.1. Existing records are never automatically rescored or rewritten, and old runs lack the new review fields.

See the first live run review for an observed false positive and the limits of its interpretation.

Live comparison — explicit opt-in

guardrails run --mode live --acknowledge-cost

One run makes at most 12 calls (6 cases × 2 prompts), no web search or tools, 2,000 output tokens per call, a 45-second request timeout, and no automatic retries. Optional --repeats 2 or --repeats 3 increases the bound to 24 or 36 calls. There is no global daily spending cap. Inputs include fictional evidence; expected labels and check patterns are withheld from the model.

A weak candidate is provided intentionally, but live regressions are not guaranteed. Edit guardrails_mcp/prompts.py to compare another candidate. Records retain both prompt texts/hashes and suite snapshots/hashes, model identifier, outputs, per-case checks, elapsed time and returned tokens. Treat timings as single-run observations. Failed requests may incur unreported usage. Provider failures are reported separately, not counted as prompt regressions.

Results persist in .guardrails/runs.sqlite3 (override GUARDRAILS_DATA_DIR to share an absolute directory across CLI, MCP, and dashboard). They are editable local records, not an immutable audit archive. Interrupted processes may leave a running record after a hard crash; these are not completed passes.

MCP

Four local stdio tools: list_cases, run_demo, list_runs, get_run. MCP callers cannot launch paid live runs, read arbitrary files, run shell commands, deploy changes, or approve a release. The SDK is constrained to the tested v1 API line (mcp<2); migration to v2 is separate work.

Example configuration for clients supporting the mcpServers format:

{
  "mcpServers": {
    "guardrails": {
      "command": "/Users/tracy-m5/Projects/GuardRails-MCP/.venv/bin/guardrails-mcp",
      "env": {
        "GUARDRAILS_DATA_DIR": "/Users/tracy-m5/Projects/GuardRails-MCP/.guardrails"
      }
    }
  }
}

No API key belongs in this configuration. Protocol behavior is tested with an MCP SDK client; the maintainer verified list_cases, run_demo and get_run through the OpenAI desktop app on October 16, 2026 (v0.1.0). This is a stdio server, not a hosted ChatGPT connector.

SignalDesk integration

python scripts/check_signaldesk.py --checkout /Users/tracy-m5/Downloads/signaldesk

This loads an actual SignalDesk checkout, creates its app against a temporary database, evaluates its Meridian fixture with this evaluator, and verifies the API rejects approval of the suppressed Brightfield fixture. It never opens the real SignalDesk database and makes no model calls. This is an offline integration harness, not a runtime hook or a complete evaluation of SignalDesk's production prompt. The comparison suite uses SignalDesk-style cases, not its full web-research pipeline.

Linux container

docker compose up --build

Dashboard: http://127.0.0.1:7861. Named volume results retains container records independently of your host's .guardrails directory. The container runs as a non-root user and receives no API key by default. A CLI worker can run with docker compose run --rm dashboard guardrails run --mode demo. The maintainer verified the v0.1.0 Docker demo and persistence across a container restart on Mac on October 16, 2026.

Evidence and known gaps

See validation, governance mapping, and registry readiness.

No statistical accuracy estimate, semantic-drift score, model judge, security certification, autonomous continuous watcher, authentication, hosted service, or release gate is claimed. The suite is visible and small; prompt authors can overfit to it. Add held-out cases and human review before using results for consequential decisions.

Tests

python -m pytest -q

No registry listing or published package is claimed.

Available Tools

4 tools

get_runA

Read-only

Read one local run, including checks, outputs, provenance, and known limitations.

ParametersJSON Schema

Name	Required	Description	Default
`run_id`	Yes

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint true, destructiveHint false, openWorldHint false), so the bar is lower. The description adds useful context by enumerating what data the read returns (checks, outputs, provenance, known limitations), though it omits any auth, rate-limit, or format details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero waste. The verb and object come first, and the included data categories follow efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple get-by-id tool with no output schema, the description usefully names the returned data categories and is supported by rich safety annotations. Its only gap is that it does not explain run_id despite 0% schema coverage, but overall it is nearly complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden for explaining run_id. It only implies that run_id identifies 'one local run' and gives no format, source, or constraints, leaving the parameter substantially under-specified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Read'), a specific resource ('one local run'), and explicitly lists the returned contents (checks, outputs, provenance, known limitations). It clearly distinguishes from the singular/plural sibling list_runs by emphasizing 'one' run.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (fetch a single run's details) but gives no explicit when-to-use guidance, no alternatives named, and no exclusions. It is adequate for an agent that already knows it needs one run by id, but offers no routing help.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_casesA

Read-only

List the six fictional, labeled cases and evaluation limitations.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=false, so safety is covered. The description adds genuinely new context: the result set is fixed at six fictional, labeled cases and also surfaces evaluation limitations, which tells the agent what it will be looking at.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. The key noun (cases) and the scope constraints (six, fictional, labeled) appear immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters, no output schema, and rich annotations, the description only needs to characterize the returned content, which it does by naming the six fictional cases and evaluation limitations. Slightly more on what a 'case' or a 'limitation' entry contains would make it fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline of 4 applies. There is nothing for the description to disambiguate, and it correctly implies the call is argument-free.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (cases) and even quantifies the scope: six fictional, labeled cases plus evaluation limitations. It is clearly distinct from run_demo/list_runs/get_run, but it never explicitly contrasts itself with those siblings, so it lands just short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to call this versus run_demo or list_runs, no prerequisites, and no indication that this is the discovery step before running a case. Any usage intent must be inferred entirely by the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_runsA

Read-only

List up to 30 local runs; running records can be stale after a hard crash.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A3.5/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is fully covered structurally. The description adds two genuinely useful behavioral facts beyond that: the 30-result cap and the staleness caveat after a hard crash. However, it says nothing about ordering, pagination past 30, or how stale records should be treated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, front-loaded with the action and scope, with the caveat appended. Every clause carries information; nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return shape needn't be described, and for a zero-parameter list tool the description covers the essentials: what is listed, the cap, and the staleness caveat. It stops short of explaining ordering or whether results beyond 30 can be retrieved, which leaves a small gap for an agent deciding how to consume the output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline for a no-param tool is 4. The 100% schema coverage is trivially satisfied.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List ... local runs') and quantifies the scope ('up to 30'). It contrasts implicitly with list_cases (cases vs runs) but never addresses get_run or run_demo, so the sibling distinction is only half-established.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use or when-not-to-use guidance, and no mention of the alternatives (get_run for a single run, list_cases for cases). The agent must infer that this is the enumeration tool from the verb alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_demoA

Run seeded fixtures with zero API calls; persist a local run. This is not model performance.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false, openWorldHint=false, destructiveHint=false, so the agent knows it writes but is non-destructive and non-networked. The description meaningfully adds that it makes 'zero API calls' and persists a 'local run', explaining the write behavior without contradicting any annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two terse, front-loaded sentences with no filler. The core action leads and the disambiguation follows.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with no output schema, the description covers the essential behaviors: no external calls, local persistence, and non-evaluation purpose. It could say more about what a 'run' record contains, but nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, and schema coverage is 100%, so there is nothing for the description to compensate for. Baseline of 4 applies since no parameter semantics are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb + resource ('Run seeded fixtures') and adds scope qualifiers ('zero API calls', 'persist a local run'). The clarifying line 'This is not model performance' helps an agent rule out an evaluation interpretation, though it doesn't name a sibling tool directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says what it is not ('not model performance') but gives no explicit when-to-use guidance or prerequisites for running a demo. Compared to the read-oriented siblings (list_cases, list_runs, get_run), the write nature is inferable only from annotations, not the description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

4 tool updatesv0.1.1Oct 16, 2026
- First observedget_run
- First observedlist_cases
- First observedlist_runs
- First observedrun_demo

Deploy Server

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

TDQS

A4/5.0

Scored 2026-10-16 18:15 across 4 tools

Disambiguation5/5

Each tool targets a distinct resource and action: list_cases covers fixed cases, run_demo creates a run, list_runs lists existing runs, and get_run retrieves a specific run. There is no overlap or ambiguity in selecting the right tool.

Naming Consistency5/5

All tool names use snake_case and follow a verb_noun pattern: list_cases, run_demo, list_runs, get_run. The convention is consistent and predictable throughout.

Tool Count5/5

Four tools are well-scoped for a focused evaluation/demo server. Each tool earns its place by covering a core operation without redundancy or bloat.

Completeness4/5

The surface covers the essential lifecycle: listing cases, running a demo, and inspecting runs. Minor gaps exist, such as no way to delete or clean up runs and no individual case retrieval, but these are likely workarounds for the stated demo purpose.

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

Need Help?

Related Servers

Related MCP Connectors

Daishi StudioOAuth
ai.daishi
Run AI agent evaluations on your own model keys, and publish runs others can review and re-run.
AI & Machine Learning Testing & QA Tools
1
Sophon Consulting A
consulting.sophon
Read-only, deterministic AI triage and readiness tools implementing Sophon's published rubrics.
AI & Machine Learning Testing & QA Tools
22
PromptOTOAuth
com.promptot
Manage, version, and publish LLM prompts with blocks, variables, and evaluations.
Developer Tools AI & Machine Learning RAG Systems
2
gtm-tools A
dev.gtmtools
A read-only verified record of agent-operable GTM tools: search, fetch, compare, track changes.
Search Marketing Research & Data
1

Related MCP Servers

EvalKit MCP Server
Penetration Testing AI & Machine Learning
tr4m0ryp
A
license
B
quality
D
maintenance
Enables testing AI safety classifier robustness against query decomposition, obfuscation, and multi-agent attacks. Provides tools for full evaluation pipelines, query previews, and status checks.
Updated 3 months ago (2026-07-11 00:52 UTC)
4
6
MIT
chinavideoai
AI & Machine Learning
gpt-img-2
A
license
A
quality
C
maintenance
Enables deterministic, read-only creation of bilingual video prompts, timed reference-aware shot plans, and focused prompt diagnostics without API keys or external provider calls.
Updated 2 months ago (2026-08-27 01:03 UTC)
4
MIT
io.github.loopg/pramana-mcp
Observability Testing & QA Tools
reliai-in
A
license
A
quality
B
maintenance
Lets an assistant read recorded production AI agent runs — steps, model and tool calls with arguments, and outcomes — along with the findings of comparison runs that checked a prompt or model change against those recordings, and verify a signed evidence bundle offline with no account or network. It is strictly read-only: no tool starts a replay or comparison, so nothing can spend money or act without a person deciding.
Updated 13 days ago (2026-10-03 20:17 UTC)
5
36 PyPI
Apache 2.0
Cognitally
Observability Monitoring Developer Tools
kamanager2012
A
license
Not graded
quality
B
maintenance
Enables AI coding agents such as Claude Code, Cursor, Codex, and OpenCode to query local token usage, costs, quotas, projects, and models through six strictly read-only tools. All data stays on the local machine, drawn from passively parsed session logs rather than uploaded telemetry.
Updated 12 days ago (2026-10-04 12:26 UTC)
MIT