# Diogenes Agent Guardrails & Sandbox MCP

> Autonomous agent guardrails, bash sandboxing, MCP rugpull diffing & prompt firewalls.

- name: io.github.stand-out-of-my-sun/diogenes-agent-guardrails-mcp
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 97/100
- quality: 89/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.stand-out-of-my-sun%2Fdiogenes-agent-guardrails-mcp
- tools: https://api.protogrid.dev/v1/servers/io.github.stand-out-of-my-sun%2Fdiogenes-agent-guardrails-mcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "diogenes-agent-guardrails-mcp": {
      "type": "http",
      "url": "https://diogenes-micro-gateway.corinth.workers.dev/mcp/agent-guardrails"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% +updated-1d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 89/100 (new)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2024-11-05; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 12 of 12 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 3,470 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history recorded for 0 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 12, about 3,470 tokens to load them all
- tool set hash: 8fa6865f900a70befc070266c0902b96
- tools last changed: 2026-10-21T04:05:20.589Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.stand-out-of-my-sun/diogenes-agent-guardrails-mcp.svg)](https://protogrid.dev/servers/io.github.stand-out-of-my-sun/diogenes-agent-guardrails-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-21 `agent_sql_guard` removed
  - AST-Level SQL Injection & Safety Guard (75 sats via L402).
- 2026-10-21 `agent_mcp_manifest_auditor` removed
  - Autonomous MCP Manifest & Tool Poisoning Auditor (150 sats via L402).
- 2026-10-21 `agent_loop_circuit_breaker` removed
  - Autonomous agent action-trace semantic loop and token-burn circuit breaker ($0.02 USDC via x402 / 70 sats).
- 2026-10-21 `mcp_sampling_guard` removed
  - MCP sampling/createMessage reverse-injection and quota-hijack firewall (100 sats via L402).
- 2026-10-21 `tool_output_firewall` removed
  - Indirect prompt-injection, invisible Unicode (U+E0000), and exfiltration-beacon tool output scrubber (75 sats via L402).
- 2026-10-21 `mcp_rugpull_diff` removed
  - MCP tools/list rug-pull and mid-session schema mutation detector (85 sats via L402).
- 2026-10-21 `scrub_pii` removed
  - Zero-PII Privacy Redaction Engine for untrusted agent inputs (150 sats via L402).
- 2026-10-21 `guardrail_verify` removed
  - Pre-execution security gate to detect prompt injection, wallet drain, and key exfiltration (100 sats via L402).
- 2026-10-21 `code_sandbox` removed
  - Secure Python code execution sandbox ($0.15 USDC via MPP on Base).
- 2026-10-21 `audit_response_factuality` added
  - Cross-references factual claims, numbers, and citations in a draft agent response against retrieved source passages to flag unsupported hallucinations before delivery. Use when verifying that a generated answer is 100% grounded in source evidence before returning it to the user; for scrubbing inbound tool outputs for prompt-injection and invisible Unicode, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'claim' ('context' defaults to 'standard'), supports '?demo=true' or L402 (150 sats), and returns HTTP 400 if invalid.

Full history: https://api.protogrid.dev/v1/servers/io.github.stand-out-of-my-sun%2Fdiogenes-agent-guardrails-mcp/changes

## Remotes

- https://diogenes-micro-gateway.corinth.workers.dev/mcp/agent-guardrails (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (12)

- `audit_mcp_server_manifest`: Scans an external MCP server's initial tools/list manifest to detect tool-name shadowing (read_file, bash) and hidden prompt-injection directives in descriptions. Use when vetting a newly discovered third-party MCP server before mounting it into an agent session; for comparing a previously pinned MCP baseline against a live mid-session tools/list response, use detect_mcp_schema_rugpull instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'manifest_json' ('audit_profile' defaults to 'strict'), supports '?demo=true' or L402 (150 sats), and returns HTTP 400 if invalid.
- `audit_outbound_egress_url`: Inspects outbound URLs and webhook targets before an agent makes HTTP requests to block cloud metadata SSRF (169.254.169.254), RFC1918 private networks, and query-string secret exfiltration. Use when validating a user-supplied or tool-supplied URL before fetching or posting data from an agent; for auditing local shell commands or general prompts, use verify_agent_command_safety instead. Read-only edge call (32 KB, 60 RPM): accepts 'target_url' ('egress_policy' defaults to 'block_private_and_metadata'), supports '?demo=true' or L402 (65 sats), and returns HTTP 400 if invalid.
- `audit_response_factuality`: Cross-references factual claims, numbers, and citations in a draft agent response against retrieved source passages to flag unsupported hallucinations before delivery. Use when verifying that a generated answer is 100% grounded in source evidence before returning it to the user; for scrubbing inbound tool outputs for prompt-injection and invisible Unicode, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'claim' ('context' defaults to 'standard'), supports '?demo=true' or L402 (150 sats), and returns HTTP 400 if invalid.
- `detect_agent_action_loop`: Analyzes an agent's recent tool-call trace to detect identical retry spins, A/B state oscillation, and runaway token burn. Use when monitoring multi-step agent execution loops to decide whether to continue or halt and escalate; for inspecting a single command payload for security threats before execution, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'action_trace_json' ('sensitivity' defaults to 'strict_2_repeats'), supports '?demo=true' or L402 (70 sats), and returns HTTP 400 if invalid.
- `detect_mcp_schema_rugpull`: Computes structural diffs between a pinned baseline MCP tools/list snapshot and a live server response to catch mid-session description or schema tampering. Use when verifying that a connected MCP server has not mutated its tool definitions mid-session; for performing a first-time static security audit on a single MCP manifest, use audit_mcp_server_manifest instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'baseline_tools_json' ('current_tools_json' defaults to 'standard'), supports '?demo=true' or L402 (85 sats), and returns HTTP 400 if invalid.
- `execute_python_sandbox`: Audits Python source code for forbidden syscalls (os, subprocess, socket, open, eval) and simulates isolated stdout execution. Use when running untrusted LLM-generated Python snippets inside an isolated sandbox; for checking shell commands or tool arguments without executing Python code, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'code' ('timeout_profile' defaults to 'fast_1s'), supports '?demo=true' or MPP (1500 sats), and returns HTTP 400 if invalid.
- `redact_sensitive_pii`: Redacts emails, phone numbers, SSNs, credit cards, API keys, and crypto private keys from text before logging or external transmission. Use when stripping personal data or secret credentials from prompts, logs, or outbound messages; for neutralizing indirect prompt injections and invisible Unicode in inbound tool responses, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'text' ('redaction_style' defaults to 'typed_token'), supports '?demo=true' or L402 (150 sats), and returns HTTP 400 if invalid.
- `sanitize_tool_output_stream`: Sanitizes untrusted external tool or web-scrape outputs by stripping invisible Unicode Tag characters (U+E0000), neutralizing Markdown tracking image beacons, and defusing indirect prompt overrides. Use when cleaning raw third-party tool outputs or scraped web text before inserting it into the LLM context window; for redacting personal identifiable information (emails, SSNs, keys) from outbound text, use redact_sensitive_pii instead. Read-only edge call (32 KB, 60 RPM): accepts 'raw_tool_output' (with enum defaults), uses '?demo=true' or L402 (75 sats); HTTP 400 if invalid.
- `validate_mcp_sampling_request`: Audits inbound MCP sampling/createMessage callbacks from connected servers to block cross-server context snooping (includeContext='allServers') and token quota hijacking. Use when filtering a connected MCP server's request to sample the host LLM; for scrubbing text returned from a standard synchronous tools/call response, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'sampling_request_json' ('max_tokens_ceiling' defaults to '512'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.
- `validate_sql_query_ast`: Parses LLM-generated SQL statements to block DDL/DML mutations (DROP, DELETE, UPDATE, GRANT), stacked queries, and UNION/comment SQL injection payloads. Use when verifying that an agent-authored SQL query is strictly read-only before running it on a database; for screening non-SQL bash commands or general agent prompts, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'query' ('dialect' defaults to 'postgres'), supports '?demo=true' or L402 (75 sats), and returns HTTP 400 if invalid.
- `verify_a2a_agent_card`: Verifies a remote agent's A2A /.well-known/agent.json discovery card, checking JWS/DID signature binding, endpoint HTTPS enforcement, and capability spoofing. Use when authenticating a peer autonomous agent before delegating subtasks or exchanging payments over A2A; for auditing an MCP tool server's tools/list manifest rather than a peer agent's A2A card, use audit_mcp_server_manifest instead. Read-only edge call (32 KB, 60 RPM): accepts 'agent_card_json' ('trust_policy' defaults to 'require_https_and_did'), supports '?demo=true' or L402 (90 sats), and returns HTTP 400 if invalid.
- `verify_agent_command_safety`: Evaluates untrusted agent prompts, bash commands, and tool arguments to block prompt injection, destructive shell commands, and private-key exfiltration. Use when screening a general shell command or user prompt before agent execution; for statically validating SQL database queries at the AST level, use validate_sql_query_ast instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'payload' ('action_type' defaults to 'bash_command'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.