AgentGuard

Overview

AgentGuard is a Human-as-a-Service (HaaS) governance layer that sits between AI agents and their tool calls. It validates every MCP tool invocation, classifies risk, and routes high-risk actions to qualified human reviewers for approval before execution.

System Architecture

AgentGuard operates as a transparent proxy between AI agents and tool servers. The core validates tool calls, classifies risk, and manages the approval lifecycle.

Components

HaaS Core (packages/haas-core)

The central governance engine. Contains the risk classifier, state machine, consensus aggregator, identity verification, AIOps learning, and MCP server implementations.

Admin Dashboard (packages/haas-dashboard)

React + Vite + Tailwind admin console. Monitors governance queue, manages policies and identity providers, and provides shareable approval links for SMEs.

Approval Page (/approve/:requestId)

Standalone page for SME/specialist review. Three-step flow: Authenticate → Verify Skills → Review & Decide. Accessed via shareable links generated from the dashboard.

Request Flow

Every tool call from an AI agent flows through the following lifecycle:

Approval Flow

When a request needs human approval, the admin dashboard generates a shareable link. The SME/specialist follows this flow:

Risk Classification

Every tool call is classified into one of four tiers based on configurable policies:

Policy Configuration

Policies are defined as JSON arrays, editable via the dashboard Settings page or loaded from config/risk-policies.example.yml:

[
  {
    "tool": "transfer_*",
    "tier": "CRITICAL",
    "threshold": 3,
    "pools": ["finance", "security", "legal"],
    "timeout": "15m",
    "conditions": [
      { "field": "amount", "operator": ">", "value": 10000 }
    ]
  },
  {
    "tool": "read_*",
    "tier": "LOW",
    "autoApprove": true
  }
]

AIOps Feedback Loop

AgentGuard learns from approval patterns and progressively adjusts risk tiers to reduce friction for consistently-approved operations.

Safety Guardrails

• CRITICAL tier is protected — never auto-downgraded, only flagged for manual review
• Configurable thresholds — default: 50 approvals to downgrade, 5 rejections to upgrade
• Full audit trail — every adjustment is logged with timestamp and reason
• Manual override — admins can lock any tool's tier via the dashboard

Skill Framework

The Skill Framework maps identity provider claims to HaaS approval pools, ensuring only qualified personnel can review specific risk categories.

Quickstart

git clone https://github.com/anthropics/agentguard.git
cd agentguard
npm install

cd packages/shared-proto && npx tsc && cd ../..
cd packages/haas-core && npx tsc && cd ../..

./deploy-mcp.sh

./deploy-mcp.sh demo

{
  "mcpServers": {
    "agentguard": {
      "command": "npx",
      "args": ["tsx", "packages/haas-core/src/mcp/mcp-server.ts"],
      "cwd": "/path/to/agentguard"
    }
  }
}

Deployment Modes

Persistent Data

Settings and audit logs are stored in .agentguard/ directory:

• .agentguard/providers.json — Identity provider configuration
• .agentguard/audit-log.json — Governance decision history
• .agentguard/policies.json — Risk policy overrides

REST API Reference

All endpoints are served from the HaaS Core HTTP server (default port 3100).

Core Endpoints

Settings Endpoints

Monitoring Endpoints

MCP Server Tools

The MCP server exposes five governance tools via the official MCP SDK:

Configuration

MCP Client Config

Add to Claude Desktop or Cursor's mcp_config.json:

{
  "mcpServers": {
    "agentguard": {
      "command": "npx",
      "args": ["tsx", "packages/haas-core/src/mcp/mcp-server.ts"],
      "cwd": "/path/to/agentguard"
    }
  }
}

Environment Variables

Project Structure

agentguard/
├── packages/
│   ├── haas-core/          # Governance engine
│   │   ├── src/
│   │   │   ├── aiops/      # AIOps + Skill Framework
│   │   │   ├── auth/       # Identity providers
│   │   │   ├── classifier/ # Risk classification
│   │   │   ├── consensus/  # Multi-sig consensus
│   │   │   ├── mcp/        # Validator + servers
│   │   │   ├── state/      # State machine + store
│   │   │   ├── storage/    # Persistent file store
│   │   │   └── telemetry/  # OpenTelemetry spans
│   │   └── tests/
│   ├── haas-dashboard/     # React admin console
│   └── shared-proto/       # Shared types + schemas
├── docs/                   # This documentation
├── config/                 # Example configurations
├── deploy-mcp.sh           # Deployment script
└── mcp-config.json         # MCP client config