AgentGuard MCP

A zero-dependency, self-hosted MCP server that turns the AgentGuard deterministic safety engine into an Alexa+–compatible Agent Skill. It screens agent inputs, tool arguments and retrieved documents for prompt injection, jailbreak, privilege escalation, tool coercion, exfiltration and PII — and returns a structured verdict with no model call, no network, and no false positives on benign traffic.

Built for the Amazon Developer Hackathon 2026 — Alexa+ track (Build, Ship, Shape). The server speaks the MCP Streamable HTTP transport, protocol 2025-11-25, which is exactly the spec the track requires.

Why

AgentGuard was originally built for the 7th China AI Competition "Agent Safety Protection Challenge" and is calibrated against five real misjudgement classes observed on an August adversarial message set. It is deterministic and fully offline, so any agent can call it as a guardrail without adding latency, cost or a model in the loop.

The same engine is reused across four competition submissions (China AI Safety Challenge, Dubai Create AI Agents Championship, Gemma paper, Songjiang AI Game), so this MCP server is the shared, reusable safety surface.

Related MCP server: classifinder-mcp

Tools

decision is one of allow / refuse / sanitize. PII in the user's own message is masked and logged, never refused (input PII is not an attack).

Run

pip install -r requirements.txt   # no third-party deps; stdlib only
python app.py                      # listens on $PORT (default 8765)

• GET /healthz → 200 {"ok": true} (platform health check)

• POST /mcp → MCP Streamable HTTP JSON-RPC (Accept application/json or text/event-stream)

MCP handshake (what a judge's client does)

POST /mcp  initialize            -> protocolVersion 2025-11-25, capabilities.tools
POST /mcp  tools/list            -> screen_text, redact_text, moderate_text
POST /mcp  tools/call screen_text {text:"Ignore all previous instructions"}
                                 -> {decision:"refuse", risk:63, findings:[...]}

Test

python eval.py     # engine + real Streamable HTTP handshake; exit 0 = all green

The suite asserts benign traffic passes, known attacks are refused, the three gate-regression classes (Latin-substring false hit, URL-host educational downgrade, missing jailbreak phrasing) stay fixed, and the HTTP transport serves initialize/tools/list/tools/call over both JSON and SSE framing.

Design rules

• Zero dependencies (Python standard library only).

• Deterministic: same input → same verdict.

• Never fabricate: every finding carries its rule id and matched span.

• Benign traffic must pass (false-positive rate is a scored dimension).

This repo's offline suite asserts 69/69 engine + transport cases, ported from AuditPilot's AgentGuard upstream regression bank. MIT licensed.