agentguard-mcp-gateway

Overview ¶

Command agentguard-mcp-gateway is the AgentGuard MCP Gateway: a stdio JSON-RPC bridge that sits between an MCP host (Claude Desktop, Cursor, IDE plugins) and one or more downstream MCP servers, gating every tools/call through the AgentGuard policy engine.

Usage:

agentguard-mcp-gateway \
    --upstream "fs:npx -y @modelcontextprotocol/server-filesystem /tmp" \
    --upstream "github:npx -y @modelcontextprotocol/server-github" \
    --guard-url http://127.0.0.1:8080 \
    --api-key $AGENTGUARD_API_KEY \
    --tenant-id local \
    --fail-mode deny \
    --policy-mode strict \
    --log-level info

stdin/stdout are reserved for newline-delimited JSON-RPC. All logging goes to stderr — the MCP spec explicitly permits this.

The host (Claude Desktop, Cursor, etc.) spawns this binary as a subprocess via its `command` configuration; the gateway in turn spawns the downstream MCP servers listed in --upstream.

See docs/MCP_GATEWAY.md for the wire-format design and docs/PROXY_ARCHITECTURE.md for cross-cutting decisions.