Summary: Through this local MCP server, you can explore evaluation cases, run the no-cost demo, and inspect stored run records.
list_cases: List the six fictional, labeled cases and evaluation limitations.
run_demo: Run seeded fixtures with zero API calls and persist a local run.
list_runs: List up to 30 local runs, including potentially stale running records.
get_run: Read one local run by run_id, including checks, outputs, provenance, and known limitations.
It does not allow paid live runs, arbitrary file reads, shell commands, deployments, or release approvals.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@GuardRails-MCP run the demo eval and show me which cases failed"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Did the prompt change actually make things better?
A small evaluation and prompt-regression tracker with a local MCP interface. Compare two prompts on six labeled fictional outreach cases, inspect failures and usage, and retain evidence for a human release decision.
v0.1.1 · local prototype · no deployment authority · no automated email
Published October 16, 2026: PyPI v0.1.1 · Official MCP Registry record. Registration establishes listing and ownership checks, not security certification.
Prompt changes often ship without evidence. A prompt is edited, a few outputs look fine, and it goes live. GuardRails-MCP gives a team a repeatable, reviewable record of what changed and what broke before a human signs off.
Who it is for: teams building agentic or LLM workflows that need release evidence, and the AI assurance, risk, and governance reviewers who have to ask for it.
What it is not: an approval authority. It produces evidence. A person makes the release decision.
Related MCP server: log-ai-compressor
flowchart LR
A[Baseline prompt] --> C[Six labeled cases]
B[Candidate prompt] --> C
C --> D[Deterministic checks]
D --> E[Run record: prompt hashes, suite hash, evaluator version, outputs]
E --> F{Phrase match only?}
F -- yes --> G[Flag: review required]
F -- no --> H[Pass or hard fail]
G --> I[Human reviews evidence]
H --> I
I --> J[Release decision<br/>outside this tool]Enforced by code | Left to a human |
Schema, labeled decision, empty holds, nonempty drafts, reference presence, source-ID membership, short forbidden-pattern list | The release decision |
Live runs bounded to at most 12 calls (24 or 36 with repeats), 2,000 output tokens per call, 45-second timeout, no automatic retries | Judging whether a phrase match is a real unsafe claim |
Paid live runs require | Claim coverage and factual support |
Four local MCP tools only: no arbitrary file reads, shell commands, deployments, or approvals | Adding held-out cases and checking for overfitting |
Each run records prompt texts and hashes, suite snapshot and hash, evaluator version, model, outputs, and per-case checks | Record retention and immutability (local records are editable) |
Provider failures are reported separately from prompt regressions | Spending limits across days (there is no global daily cap) |
This describes the design of a small evaluation prototype. It is not compliance, certification, or coverage of an entire framework. The full table, including OWASP LLM Top 10 lenses, is in docs/GOVERNANCE.md.
Function | Implemented evidence or control | Known gap |
Govern | Documented evaluation boundary; MCP cannot authorize deployment or spend API credits | No authenticated roles, assigned organizational owner, or policy enforcement |
Map | Six labeled fictional outreach cases and explicit intended behavior | No stakeholder or impact assessment; only one workflow |
Measure | Case checks, provenance snapshots, latency and returned token counts, paired regressions | No semantic truth verifier, confidence intervals, comprehensive adversarial set, or live accuracy benchmark |
Manage | Explicit CLI cost opt-in, request and output limits, error visibility | No daily budget, monitoring or alerting, automatic remediation, or release gate |
Seeded demo using six fictional cases: baseline 6/6, deliberately regressed candidate 3/6. These are hand-authored fixtures, not measured model performance.
Recorded-run details, review guidance, and known gaps
The interface keeps evaluator version, prompt provenance, review guidance, and known gaps visible. This screenshot shows the guidance and run metadata; it does not display an individual phrase-match assessment.
Python 3.11+, in an activated virtual environment:
python -m pip install "guardrails-mcp[dashboard]==0.1.1"
guardrails run --mode demo
guardrails-dashboardOpen http://127.0.0.1:7861. Demo results are hand-authored: baseline passes 6/6; a deliberately regressed candidate passes 3/6. This tests the scoring and reporting path, not model performance. Gradio runs locally; no Hugging Face account or hosting subscription is needed.
Your .env can contain OPENAI_API_KEY and OPENAI_MODEL=gpt-5-mini. No key is needed for demo mode or MCP tools. Never commit .env.
For source development, clone this repository and install with python -m pip install -e '.[dev,dashboard]'.
Case | Expected behavior |
Supported reporting workflow | Draft with source references |
Do Not Contact | Block and return no outreach |
Missing workflow evidence | Hold and return no outreach |
Conflicting contact role | Hold and return no outreach |
Unsupported seller history | Avoid selected invented-history phrases |
Instructions inside source text | Avoid selected injected promises |
Checks validate schema, the labeled decision, empty holds, nonempty drafts, reference presence, source-ID membership, and a short forbidden-pattern list. They do not establish complete claim coverage, factual support, general injection resistance, or semantic equivalence. A test explicitly demonstrates a false claim that these checks miss.
A literal pattern match is not proof of an unsafe claim. New records include phrase_matches with field, pattern, matched text, offsets and surrounding excerpt; review_required; and an assessment of pass, review, or fail. A phrase-only failure receives review; other deterministic failures remain fail even when a phrase also matches. This does not automatically approve negations or quotations.
Raw passed, failures, and regression counts remain conservative and unchanged in meaning: every check must pass. Summary review_only counts identify phrase-only cases within those raw failures. hard_failures excludes phrase matches but does not imply semantic verification. New runs record evaluator version 0.1.1. Existing records are never automatically rescored or rewritten, and old runs lack the new review fields.
See the first live run review for an observed false positive and the limits of its interpretation.
guardrails run --mode live --acknowledge-costOne run makes at most 12 calls (6 cases × 2 prompts), no web search or tools, 2,000 output tokens per call, a 45-second request timeout, and no automatic retries. Optional --repeats 2 or --repeats 3 increases the bound to 24 or 36 calls. There is no global daily spending cap. Inputs include fictional evidence; expected labels and check patterns are withheld from the model.
A weak candidate is provided intentionally, but live regressions are not guaranteed. Edit guardrails_mcp/prompts.py to compare another candidate. Records retain both prompt texts and hashes, suite snapshots and hashes, model identifier, outputs, per-case checks, elapsed time and returned tokens. Treat timings as single-run observations. Failed requests may incur unreported usage. Provider failures are reported separately, not counted as prompt regressions.
Results persist in .guardrails/runs.sqlite3 (override GUARDRAILS_DATA_DIR to share an absolute directory across CLI, MCP, and dashboard). They are editable local records, not an immutable audit archive. Interrupted processes may leave a running record after a hard crash; these are not completed passes.
Four local stdio tools: list_cases, run_demo, list_runs, get_run. MCP callers cannot launch paid live runs, read arbitrary files, run shell commands, deploy changes, or approve a release. The SDK is constrained to the tested v1 API line (mcp<2); migration to v2 is separate work.
Example configuration for clients supporting the mcpServers format. Replace the paths with your own:
{
"mcpServers": {
"guardrails": {
"command": "/path/to/your/.venv/bin/guardrails-mcp",
"env": {
"GUARDRAILS_DATA_DIR": "/path/to/your/.guardrails"
}
}
}
}No API key belongs in this configuration. Protocol behavior is tested with an MCP SDK client, and the maintainer verified list_cases, run_demo and get_run through the OpenAI desktop app, including at v0.1.1. This is a stdio server, not a hosted ChatGPT connector. Installing through the registry listing has not been tested; see validation.
python scripts/check_signaldesk.py --checkout /path/to/signaldeskThis loads an actual SignalDesk checkout, creates its app against a temporary database, evaluates its Meridian fixture with this evaluator, and verifies the API rejects approval of the suppressed Brightfield fixture. It never opens the real SignalDesk database and makes no model calls. This is an offline integration harness, not a runtime hook or a complete evaluation of SignalDesk's production prompt. The comparison suite uses SignalDesk-style cases, not its full web-research pipeline.
docker compose up --buildDashboard: http://127.0.0.1:7861. Named volume results retains container records independently of your host's .guardrails directory. The container runs as a non-root user and receives no API key by default. A CLI worker can run with docker compose run --rm dashboard guardrails run --mode demo. The maintainer verified the Docker demo and persistence across a container restart. One earlier unexplained container exit (code 137) is documented in validation; its cause is unconfirmed.
See validation, governance mapping, release notes, and registry listing.
No statistical accuracy estimate, semantic-drift score, model judge, security certification, autonomous continuous watcher, authentication, hosted service, or release gate is claimed. The suite is visible and small; prompt authors can overfit to it. Add held-out cases and human review before using results for consequential decisions.
Not built yet. These are the gaps described above, listed as candidate next steps:
Held-out cases kept separate from the visible suite, to reduce overfitting.
Optional model-judge check, clearly labeled and kept separate from the deterministic checks.
Immutable audit logging, so run records cannot be edited after the fact.
Semantic checks for claim coverage and factual support beyond phrase matching.
A daily spend cap for live runs.
python -m pytest -qLicensed under the MIT License. Copyright © 2026 Tracy Anne Griffin Manning.
Read one local run, including checks, outputs, provenance, and known limitations.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint true, destructiveHint false, openWorldHint false), so the bar is lower. The description adds useful context by enumerating what data the read returns (checks, outputs, provenance, known limitations), though it omits any auth, rate-limit, or format details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero waste. The verb and object come first, and the included data categories follow efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple get-by-id tool with no output schema, the description usefully names the returned data categories and is supported by rich safety annotations. Its only gap is that it does not explain run_id despite 0% schema coverage, but overall it is nearly complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden for explaining run_id. It only implies that run_id identifies 'one local run' and gives no format, source, or constraints, leaving the parameter substantially under-specified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read'), a specific resource ('one local run'), and explicitly lists the returned contents (checks, outputs, provenance, known limitations). It clearly distinguishes from the singular/plural sibling list_runs by emphasizing 'one' run.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (fetch a single run's details) but gives no explicit when-to-use guidance, no alternatives named, and no exclusions. It is adequate for an agent that already knows it needs one run by id, but offers no routing help.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the six fictional, labeled cases and evaluation limitations.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=false, so safety is covered. The description adds genuinely new context: the result set is fixed at six fictional, labeled cases and also surfaces evaluation limitations, which tells the agent what it will be looking at.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. The key noun (cases) and the scope constraints (six, fictional, labeled) appear immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters, no output schema, and rich annotations, the description only needs to characterize the returned content, which it does by naming the six fictional cases and evaluation limitations. Slightly more on what a 'case' or a 'limitation' entry contains would make it fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline of 4 applies. There is nothing for the description to disambiguate, and it correctly implies the call is argument-free.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (cases) and even quantifies the scope: six fictional, labeled cases plus evaluation limitations. It is clearly distinct from run_demo/list_runs/get_run, but it never explicitly contrasts itself with those siblings, so it lands just short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to call this versus run_demo or list_runs, no prerequisites, and no indication that this is the discovery step before running a case. Any usage intent must be inferred entirely by the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List up to 30 local runs; running records can be stale after a hard crash.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is fully covered structurally. The description adds two genuinely useful behavioral facts beyond that: the 30-result cap and the staleness caveat after a hard crash. However, it says nothing about ordering, pagination past 30, or how stale records should be treated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the action and scope, with the caveat appended. Every clause carries information; nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return shape needn't be described, and for a zero-parameter list tool the description covers the essentials: what is listed, the cap, and the staleness caveat. It stops short of explaining ordering or whether results beyond 30 can be retrieved, which leaves a small gap for an agent deciding how to consume the output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline for a no-param tool is 4. The 100% schema coverage is trivially satisfied.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List ... local runs') and quantifies the scope ('up to 30'). It contrasts implicitly with list_cases (cases vs runs) but never addresses get_run or run_demo, so the sibling distinction is only half-established.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance, and no mention of the alternatives (get_run for a single run, list_cases for cases). The agent must infer that this is the enumeration tool from the verb alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run seeded fixtures with zero API calls; persist a local run. This is not model performance.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=false, openWorldHint=false, destructiveHint=false, so the agent knows it writes but is non-destructive and non-networked. The description meaningfully adds that it makes 'zero API calls' and persists a 'local run', explaining the write behavior without contradicting any annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two terse, front-loaded sentences with no filler. The core action leads and the disambiguation follows.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no output schema, the description covers the essential behaviors: no external calls, local persistence, and non-evaluation purpose. It could say more about what a 'run' record contains, but nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, and schema coverage is 100%, so there is nothing for the description to compensate for. Baseline of 4 applies since no parameter semantics are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb + resource ('Run seeded fixtures') and adds scope qualifiers ('zero API calls', 'persist a local run'). The clarifying line 'This is not model performance' helps an agent rule out an evaluation interpretation, though it doesn't name a sibling tool directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description says what it is not ('not model performance') but gives no explicit when-to-use guidance or prerequisites for running a demo. Compared to the read-oriented siblings (list_cases, list_runs, get_run), the write nature is inferable only from annotations, not the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.1get_runlist_caseslist_runsrun_demoScored across 4 tools
Each tool targets a distinct resource and action: list_cases covers fixed cases, run_demo creates a run, list_runs lists existing runs, and get_run retrieves a specific run. There is no overlap or ambiguity in selecting the right tool.
All tool names use snake_case and follow a verb_noun pattern: list_cases, run_demo, list_runs, get_run. The convention is consistent and predictable throughout.
Four tools are well-scoped for a focused evaluation/demo server. Each tool earns its place by covering a core operation without redundancy or bloat.
The surface covers the essential lifecycle: listing cases, running a demo, and inspecting runs. Minor gaps exist, such as no way to delete or clean up runs and no individual case retrieval, but these are likely workarounds for the stated demo purpose.
Run AI agent evaluations on your own model keys, and publish runs others can review and re-run.
LLM & RAG evals: hallucination, eval contracts, semantic tests, tokens & model info. Free, no key.
Run AI evaluations, record agent traces and gate releases on evidence, with scoped org access.
Read-only, deterministic AI triage and readiness tools implementing Sophon's published rubrics.