Skip to main content
Glama
ultus-net

workflow-guard-mcp

by ultus-net

workflow-guard-mcp

Model Context Protocol(MCP)을 사용하는 에이전트형 코딩 클라이언트를 위한 이식 가능한 안전장치입니다.

이 프로젝트는 클라이언트에 공유 정책 판단 지점을 제공하여 빠르고 고도로 자율적인 코딩 워크플로의 피해 범위를 줄이기 위한 것입니다. MCP 서버는 제안된 작업을 자체적으로 실행하지 않습니다.

상태

이 저장소는 초기 스캐폴드입니다. 현재 guard_check 도구는 안정적인 정책 결정 계약을 보여주지만 아직 opencode-workflow-guard 정책의 완전한 포트는 아닙니다.

가장 중요한 점은 MCP 서버를 연결한다고 해서 코딩 클라이언트가 실행할 수 있는 모든 네이티브 도구에 대한 인터셉터가 되는 것은 아니라는 것입니다. 강제 실행은 호스트의 통합 지원에 달려 있습니다. 호환성 및 계획을 참조하세요.

Related MCP server: Laguarde

도구

  • guard_check: 제안된 shell, file_write, git 또는 network 작업을 평가하고 기계가 읽을 수 있는 정책 ID와 함께 allow, deny 또는 ask를 반환합니다.

  • guard_status: 서버의 현재 강제 실행 모드를 보고합니다. 이 스캐폴드가 호스트에 종속적인 정책 조언임을 명시적으로 식별합니다.

개발

Node.js 20 이상이 필요합니다.

npm install
npm test
npm run typecheck
npm run build

초기 전송 방식은 stdio입니다. Claude Code와 Codex 모두 로컬 stdio MCP 서버를 지원하기 때문입니다. Streamable HTTP는 정책 API를 변경하지 않고 추가할 수 있습니다.

설계 원칙

공개적인 약속은 의도적으로 "이 MCP가 코딩 에이전트를 샌드박싱한다"보다 좁게 설정되어 있습니다. 정책을 중앙화합니다. 클라이언트 어댑터는 클라이언트가 신뢰할 수 있는 차단 메커니즘을 노출하는 모든 곳에서 해당 정책을 강제 실행합니다. 그렇지 않은 경우 결과는 권고 사항으로 남으며 클라이언트의 네이티브 샌드박스 및 승인 제어와 결합되어야 합니다.

출처

호환성 설계는 2026-08-27일 현재 공식 문서와 소스를 기준으로 확인되었습니다:

라이선스

MIT

Available Tools

2 tools
guard_checkB

Evaluate a proposed coding-agent action. Advisory unless the host wires the result into enforcement.

NameRequiredDescriptionDefault
pathNo
actionYes
commandNo

TDQS

B3.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose an important non-obvious trait: the result is advisory unless the host wires it into enforcement. The wording 'Evaluate' also implies analysis rather than execution, giving the agent a reasonable safety picture, though side effects and return behavior are not explicitly addressed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, front-loaded sentences with no filler: the first states the purpose, the second states a critical caveat about enforcement. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, no annotations, and zero parameter documentation, the description is too thin. It leaves the return value undefined, does not clarify the semantics of path/command/action, and does not say what a typical verdict looks like. An agent would likely need additional probing to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description adds no meaning for `path`, `action`, or `command`. The enum in the schema hints at action types, but the description does not explain how the parameters relate to the evaluation, what values mean, or when each is relevant, so it fails to compensate for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Evaluate') and a clear object ('a proposed coding-agent action'), which makes the tool's basic function understandable. It does not explicitly contrast with the sibling guard_status, but 'Evaluate a proposed action' versus 'status' is a strong enough distinction for an agent to pick the right tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is meant to be used when there is a proposed coding-agent action to assess, but it does not explicitly say when to use guard_check vs guard_status or when not to use it. The advisory/enforcement caveat gives useful context about reliance, but there is no routing guidance or exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

guard_statusA

Report guard capabilities and the enforcement boundary.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears the full burden. The verb 'Report' implies a read-only, informational operation, which is a useful behavioral signal, but the description does not explicitly state side-effect freedom, authentication needs, or any operational constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. It communicates the core purpose in nine words, and every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, no-output-schema tool, the description adequately states what the tool reports ('guard capabilities' and 'enforcement boundary'). It is minimal but sufficient for invocation, though some domain-specific meaning of 'enforcement boundary' is left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the input schema is fully complete. Per the baseline for zero-parameter tools, the description need not add parameter-level detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Report') and identifies a clear resource ('guard capabilities and the enforcement boundary'). It is not a tautology and gives the agent a concrete sense of what the tool does, though it does not explicitly contrast with the sibling 'guard_check'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus its sibling 'guard_check'. There is no mention of preferred scenarios, exclusions, or alternative routing, leaving the agent to infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.1.0
    • First observedguard_check
    • First observedguard_status

TDQS

A3.7/5.0

Scored across 2 tools

Disambiguation5/5

guard_check and guard_status have clearly distinct purposes: one evaluates an action, the other reports capabilities and enforcement boundaries. There is no overlap or ambiguity between them.

Naming Consistency5/5

Both tools follow a consistent guard_ prefix with lowercase underscore naming. The pattern is uniform and predictable.

Tool Count3/5

With only 2 tools, the server feels thin even for its narrow purpose. The count is borderline, sitting at the low end of what might be considered a minimal but workable surface.

Completeness4/5

The two tools cover the core guard workflow (evaluate action, check status) with only minor gaps like listing specific rules or explaining decisions. Agents can likely work around these by using the provided tools.

Maintenance

ActivityStale
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enforces deterministic policies on AI agent tool calls, evaluating actions against compliance modules (SOC 2, HIPAA, GDPR, etc.) and returning ALLOW, BLOCK, or CONSTRAIN decisions with an audit trail.
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI coding agents to evaluate actions against team-defined policies, record decisions, and obtain human approvals for potentially risky operations.
    38 npm
    1
    -
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enforces policy controls for AI agents, including spend limits, action approvals, kill switch, scoped credentials, dry-run diffs, loop prevention, and auditable hash-chained logs.
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enforces deterministic policy decisions on AI agent tool calls, supporting allow, deny, correct, escalate, and human review actions with verifiable audit receipts.
    10 npm
    MIT