🐕🦺 CerbereAG MCP Server
Runtime security for AI agents — as an MCP server.
CerbereAG MCP lets any MCP-compatible AI agent (Claude, Cursor, Cline, custom agents built on the Anthropic API) check its own prompts and tool calls for security risk in real time, using the Model Context Protocol.
It wraps the cerbere-ag SDK's
policy engine and exposes it as MCP tools, so an agent can call
check_prompt_security or authorize_tool_call the same way it would call
any other tool — no separate API integration required.
🚀 Quick start (30 seconds)
1. Install
pip install cerbere-ag-mcp
2. Configure your MCP client
Claude Desktop — add to claude_desktop_config.json:
{
"mcpServers": {
"cerbereag": {
"command": "cerbere-ag-mcp",
"env": {
"AGENTGUARD_MCP_COLLECTOR_URL": "https://YOUR_AGENTGUARD_HOST",
"AGENTGUARD_API_KEY": "ag-your-key",
"AGENTGUARD_AGENT_ID": "my-agent"
}
}
}
}
Cursor — add to .cursor/mcp.json in your project:
{
"mcpServers": {
"cerbereag": {
"command": "cerbere-ag-mcp",
"env": {
"AGENTGUARD_MCP_COLLECTOR_URL": "https://YOUR_AGENTGUARD_HOST",
"AGENTGUARD_API_KEY": "ag-your-key",
"AGENTGUARD_AGENT_ID": "my-agent"
}
}
}
}
Restart the client. The tools below become available to the agent automatically — no code changes needed on your side.
🛠️ Available tools
| Tool | Purpose |
|---|---|
check_prompt_security(text) |
Checks a text for prompt injection patterns or PII leakage before it's sent onward. |
authorize_tool_call(tool_name, params_json, agent_id?) |
Checks whether a planned tool call is allowed under the active policy and remaining budget. |
redact_pii(text) |
Replaces detected PII (emails, phone numbers, card numbers, SSNs, API keys) with [REDACTED_TYPE] placeholders. |
get_audit_trail(limit?) |
Fetches the most recent entries from the security audit log on the Collector. |
calculate_token_cost(model, text) |
Estimates token count and USD cost for a piece of text against a given model's pricing. |
📚 Available resource
| Resource | Purpose |
|---|---|
cerbereag://policies/summary |
Returns a summary of the currently active tool allowlist and detection settings. |
⚙️ Configuration
| Environment variable | Required | Default | Description |
|---|---|---|---|
AGENTGUARD_MCP_COLLECTOR_URL |
No | http://localhost:8080 |
URL of your CerbereAG Collector instance. |
AGENTGUARD_API_KEY |
Recommended | — | API key used to authenticate against the Collector. |
AGENTGUARD_AGENT_ID |
No | cerbereag_mcp_client |
Identifier used to scope policy and budget checks. |
AGENTGUARD_MAX_BUDGET |
No | 10.0 |
Max USD spend before authorize_tool_call starts blocking on budget. |
🧩 Running it manually (for testing)
AGENTGUARD_MCP_COLLECTOR_URL=http://localhost:8080 \
AGENTGUARD_API_KEY=ag-your-key \
cerbere-ag-mcp
The server starts on stdio, as expected by MCP clients — it is not meant to be run as a standalone HTTP service.
🔗 Related
- Core SDK (decorator-based integration for Python agents):
cerbere-ag - Dashboard, policy docs, other framework integrations (LangGraph, CrewAI, Composio, HTTP gateway): app.cerbereag.site
- Source: github.com/chrismsmr-celcom/agentguard
Release files for cerbere-ag-mcp 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| cerbere_ag_mcp-0.1.0.tar.gz | 6.0 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| cerbere_ag_mcp-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 12.3 kB
Release files / cerbere_ag_mcp-0.1.0.tar.gz
| Download URL | cerbere_ag_mcp-0.1.0.tar.gz |
|---|---|
| Size | 6.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
fcc17db8000454bd80245ae6bbaeaaf66959badea6d3e876a17d2ade86fadd78
|
|
BLAKE2b-256 checksum How to use checksums |
f3dc6bc88b1dc1f52aac9486340f74c395591db7d7f2ae725a03ca344caf01e1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 14, 2026.
Transparency logRelease files / cerbere_ag_mcp-0.1.0-py3-none-any.whl
| Download URL | cerbere_ag_mcp-0.1.0-py3-none-any.whl |
|---|---|
| Size | 6.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
3379ad587616d59144a784df8c0aee498fdff8cbf753925236b64182a3fae7e8
|
|
BLAKE2b-256 checksum How to use checksums |
6aa004cb34f74d3ef7d3d0e5f700a5d078c630fcf5d631f81f027a6e8dfa06c0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 14, 2026.
Transparency log