Agent Policy Gateway MCP Server

Compliance and guardrails server for AI agents. Gives companies the tools to run AI agents safely and within regulatory boundaries.

Why This Exists

As AI agents gain autonomy — making purchases, accessing data, sending emails — companies face real compliance risks:

• GDPR (EU): Agents processing personal data must follow strict rules. Violations cost up to 4% of global revenue.
• EU AI Act (2024): High-risk AI systems need human oversight, transparency, and documentation. Non-compliance means fines up to 35M EUR.
• Internal Policies: Companies need spend limits, allowed actions, domain restrictions, and audit trails.

This server provides the "boring infrastructure" that makes autonomous agents enterprise-ready.

Tools

Installation

# Via pip
pip install agent-policy-gateway-mcp

# Via uvx (no install needed)
uvx agent-policy-gateway-mcp

Configuration

Add to your MCP client config:

{
  "mcpServers": {
    "policy-gateway": {
      "command": "uvx",
      "args": ["agent-policy-gateway-mcp"]
    }
  }
}

Or with pip install:

{
  "mcpServers": {
    "policy-gateway": {
      "command": "policy-gateway-server"
    }
  }
}

Usage Examples

PII Detection Before External Calls

check_pii("Send invoice to john.doe@company.com, CC 4532-1234-5678-9012")
→ has_pii: true, found: [email, credit_card], redacted version provided

Guardrails for Agent Actions

apply_guardrails("make_purchase", {"amount_usd": 500})
→ denied: exceeds $100 spend limit

apply_guardrails("send_email", {})
→ allowed

apply_guardrails("delete_user_data")
→ denied: blocked action

Compliance Check

check_compliance("automated_decision", "EU")
→ risk_level: high
→ requirements: human oversight, transparency, documentation, fairness audits
→ gdpr_articles: Art. 22 GDPR

Emergency Stop

emergency_stop("agent-007", "Agent attempting unauthorized data export")
→ kill_switch: true, logged to audit trail

Compliance Coverage

EU AI Act Risk Levels

• Unacceptable: Biometric identification (real-time) — blocked
• High: Automated decisions, credit scoring, recruitment, customer profiling
• Limited: Content moderation, data processing
• Minimal: Chatbot interactions

GDPR Articles Referenced

• Art. 6 — Lawfulness of processing
• Art. 9 — Special categories of data
• Art. 13/14 — Information obligations
• Art. 21 — Right to object
• Art. 22 — Automated decision-making
• Art. 30 — Records of processing
• Art. 35 — Data protection impact assessment

Audit Log Format

Logs are stored as JSONL files in ~/.agent-audit-log/:

{"entry_id": "agent-1_1710936000000", "timestamp": "2024-03-20T12:00:00+00:00", "agent_id": "agent-1", "action": "api_call", "details": "Called external pricing API"}

License

MIT