workflow-guard-mcp
Provides OpenAI Codex with a shared policy decision point for proposed shell, file write, git, and network actions, returning allow, deny, or ask verdicts.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@workflow-guard-mcpCheck if this action is allowed: git push --force"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
workflow-guard-mcp
Portable guardrails for agentic coding clients that speak the Model Context Protocol (MCP).
The project is intended to reduce the blast radius of fast, highly autonomous coding workflows by giving clients a shared policy decision point. The MCP server does not execute the proposed action itself.
Status
This repository is an early scaffold. The current guard_check tool demonstrates a stable policy-decision contract; it is not yet a complete port of opencode-workflow-guard policies.
Most importantly, connecting an MCP server does not make it an interceptor for every native tool a coding client can execute. Hard enforcement depends on integration support in the host. See Compatibility and Plan.
Related MCP server: Vaikora Guard MCP
Tools
guard_check: evaluates a proposedshell,file_write,git, ornetworkaction and returnsallow,deny, oraskwith a machine-readable policy ID.guard_status: reports the server's current enforcement mode. It explicitly identifies this scaffold as host-dependent policy advice.
Development
Requires Node.js 20 or newer.
npm install
npm test
npm run typecheck
npm run buildThe initial transport is stdio because both Claude Code and Codex support local stdio MCP servers. Streamable HTTP can be added without changing the policy API.
Design Principle
The public promise is deliberately narrower than "this MCP sandboxes your coding agent." It centralizes policy. Client adapters enforce that policy wherever the client exposes a trustworthy interception mechanism; otherwise the result remains advisory and should be combined with the client's native sandbox and approval controls.
Sources
The compatibility design was checked against current official documentation and source on 2026-08-27:
Anthropic Claude Code MCP: https://docs.claude.com/en/docs/claude-code/mcp
Anthropic Claude Code hooks: https://github.com/anthropics/claude-code/blob/main/plugins/plugin-dev/skills/hook-development/SKILL.md
OpenAI Codex: https://github.com/openai/codex
Codex MCP configuration implementation: https://github.com/openai/codex/blob/main/codex-rs/config/src/mcp_types.rs
MCP TypeScript SDK: https://github.com/modelcontextprotocol/typescript-sdk/blob/v1.29.0/docs/server.md
License
MIT
Available Tools
2 toolsguard_checkB
Evaluate a proposed coding-agent action. Advisory unless the host wires the result into enforcement.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| action | Yes | ||
| command | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose an important non-obvious trait: the result is advisory unless the host wires it into enforcement. The wording 'Evaluate' also implies analysis rather than execution, giving the agent a reasonable safety picture, though side effects and return behavior are not explicitly addressed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, front-loaded sentences with no filler: the first states the purpose, the second states a critical caveat about enforcement. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema, no annotations, and zero parameter documentation, the description is too thin. It leaves the return value undefined, does not clarify the semantics of path/command/action, and does not say what a typical verdict looks like. An agent would likely need additional probing to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no meaning for `path`, `action`, or `command`. The enum in the schema hints at action types, but the description does not explain how the parameters relate to the evaluation, what values mean, or when each is relevant, so it fails to compensate for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Evaluate') and a clear object ('a proposed coding-agent action'), which makes the tool's basic function understandable. It does not explicitly contrast with the sibling guard_status, but 'Evaluate a proposed action' versus 'status' is a strong enough distinction for an agent to pick the right tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is meant to be used when there is a proposed coding-agent action to assess, but it does not explicitly say when to use guard_check vs guard_status or when not to use it. The advisory/enforcement caveat gives useful context about reliance, but there is no routing guidance or exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
guard_statusA
Report guard capabilities and the enforcement boundary.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears the full burden. The verb 'Report' implies a read-only, informational operation, which is a useful behavioral signal, but the description does not explicitly state side-effect freedom, authentication needs, or any operational constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. It communicates the core purpose in nine words, and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema tool, the description adequately states what the tool reports ('guard capabilities' and 'enforcement boundary'). It is minimal but sufficient for invocation, though some domain-specific meaning of 'enforcement boundary' is left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the input schema is fully complete. Per the baseline for zero-parameter tools, the description need not add parameter-level detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Report') and identifies a clear resource ('guard capabilities and the enforcement boundary'). It is not a tautology and gives the agent a concrete sense of what the tool does, though it does not explicitly contrast with the sibling 'guard_check'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its sibling 'guard_check'. There is no mention of preferred scenarios, exclusions, or alternative routing, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
2 tool updates
v0.1.0- First observed
guard_check - First observed
guard_status
TDQS
guard_check and guard_status have clearly distinct purposes: one evaluates an action, the other reports capabilities and enforcement boundaries. There is no overlap or ambiguity between them.
Both tools follow a consistent guard_ prefix with lowercase underscore naming. The pattern is uniform and predictable.
With only 2 tools, the server feels thin even for its narrow purpose. The count is borderline, sitting at the low end of what might be considered a minimal but workable surface.
The two tools cover the core guard workflow (evaluate action, check status) with only minor gaps like listing specific rules or explaining decisions. Agents can likely work around these by using the provided tools.
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Deterministic allow/require_approval/deny verdicts for agent actions, before they happen.
Fail-closed policy guardrails for AI agents running kubectl, terraform, helm, and argocd.
Git-native policy layer for AI agents: check_action verdicts against rules approved via PR.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Related MCP Servers
- AlicenseAqualityDmaintenanceRuntime policy enforcement for AI agents. Evaluate every agent action against your organization's policies before execution, with observe and enforce modes.11MIT

Vaikora Guard MCPofficial
AlicenseNot gradedqualityDmaintenanceEnforces deterministic policies on AI agent tool calls, evaluating actions against compliance modules (SOC 2, HIPAA, GDPR, etc.) and returning ALLOW, BLOCK, or CONSTRAIN decisions with an audit trail.MIT- FlicenseNot gradedqualityBmaintenanceEnables AI coding agents to evaluate actions against team-defined policies, record decisions, and obtain human approvals for potentially risky operations.1501-
- FlicenseNot gradedqualityCmaintenanceEnables controlled AI-agent access to enterprise-shaped tools with a deny-by-default gated write path, human approval, dry-run execution, and append-only audit logging.1-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/ultus-net/workflow-guard-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server