GuardRails-MCP

Did the prompt change actually make things better?

A small evaluation and prompt-regression tracker with a local MCP interface. Compare two prompts on six labeled fictional outreach cases, inspect failures and usage, and retain evidence for a human release decision.

v0.1.1 · local prototype · no deployment authority · no automated email

Start with the no-cost demo

Python 3.11+ (Mac setup uses your existing project virtual environment):

python -m pip install -e '.[dev,dashboard]'
guardrails run --mode demo
guardrails-dashboard

Open http://127.0.0.1:7861. Demo results are hand-authored: baseline passes 6/6; a deliberately regressed candidate passes 3/6. This tests the scoring/reporting path, not model performance. Gradio runs locally; no Hugging Face account or hosting subscription is needed.

Your .env can contain OPENAI_API_KEY and OPENAI_MODEL=gpt-5-mini. No key is needed for demo mode or MCP tools. Never commit .env.

What it checks

Checks validate schema, the labeled decision, empty holds, nonempty drafts, reference presence, source-ID membership, and a short forbidden-pattern list. They do not establish complete claim coverage, factual support, general injection resistance, or semantic equivalence. A test explicitly demonstrates a false claim that these checks miss.

Phrase matches require review

A literal pattern match is not proof of an unsafe claim. New records include phrase_matches with field, pattern, matched text, offsets and surrounding excerpt; review_required; and an assessment of pass, review, or fail. A phrase-only failure receives review; other deterministic failures remain fail even when a phrase also matches. This does not automatically approve negations or quotations.

Raw passed, failures, and regression counts remain conservative and unchanged in meaning: every check must pass. Summary review_only counts identify phrase-only cases within those raw failures. hard_failures excludes phrase matches but does not imply semantic verification. New runs record evaluator version 0.1.1. Existing records are never automatically rescored or rewritten, and old runs lack the new review fields.

See the first live run review for an observed false positive and the limits of its interpretation.

Live comparison — explicit opt-in

guardrails run --mode live --acknowledge-cost

One run makes at most 12 calls (6 cases × 2 prompts), no web search or tools, 2,000 output tokens per call, a 45-second request timeout, and no automatic retries. Optional --repeats 2 or --repeats 3 increases the bound to 24 or 36 calls. There is no global daily spending cap. Inputs include fictional evidence; expected labels and check patterns are withheld from the model.

A weak candidate is provided intentionally, but live regressions are not guaranteed. Edit guardrails_mcp/prompts.py to compare another candidate. Records retain both prompt texts/hashes and suite snapshots/hashes, model identifier, outputs, per-case checks, elapsed time and returned tokens. Treat timings as single-run observations. Failed requests may incur unreported usage. Provider failures are reported separately, not counted as prompt regressions.

Results persist in .guardrails/runs.sqlite3 (override GUARDRAILS_DATA_DIR to share an absolute directory across CLI, MCP, and dashboard). They are editable local records, not an immutable audit archive. Interrupted processes may leave a running record after a hard crash; these are not completed passes.

MCP

Four local stdio tools: list_cases, run_demo, list_runs, get_run. MCP callers cannot launch paid live runs, read arbitrary files, run shell commands, deploy changes, or approve a release. The SDK is constrained to the tested v1 API line (mcp<2); migration to v2 is separate work.

Example configuration for clients supporting the mcpServers format:

{
  "mcpServers": {
    "guardrails": {
      "command": "/Users/tracy-m5/Projects/GuardRails-MCP/.venv/bin/guardrails-mcp",
      "env": {
        "GUARDRAILS_DATA_DIR": "/Users/tracy-m5/Projects/GuardRails-MCP/.guardrails"
      }
    }
  }
}

No API key belongs in this configuration. Protocol behavior is tested with an MCP SDK client; the maintainer verified list_cases, run_demo and get_run through the OpenAI desktop app on October 16, 2026 (v0.1.0). This is a stdio server, not a hosted ChatGPT connector.

SignalDesk integration

python scripts/check_signaldesk.py --checkout /Users/tracy-m5/Downloads/signaldesk

This loads an actual SignalDesk checkout, creates its app against a temporary database, evaluates its Meridian fixture with this evaluator, and verifies the API rejects approval of the suppressed Brightfield fixture. It never opens the real SignalDesk database and makes no model calls. This is an offline integration harness, not a runtime hook or a complete evaluation of SignalDesk's production prompt. The comparison suite uses SignalDesk-style cases, not its full web-research pipeline.

Linux container

docker compose up --build

Dashboard: http://127.0.0.1:7861. Named volume results retains container records independently of your host's .guardrails directory. The container runs as a non-root user and receives no API key by default. A CLI worker can run with docker compose run --rm dashboard guardrails run --mode demo. The maintainer verified the v0.1.0 Docker demo and persistence across a container restart on Mac on October 16, 2026.

Evidence and known gaps

See validation, governance mapping, and registry readiness.

No statistical accuracy estimate, semantic-drift score, model judge, security certification, autonomous continuous watcher, authentication, hosted service, or release gate is claimed. The suite is visible and small; prompt authors can overfit to it. Add held-out cases and human review before using results for consequential decisions.

Tests

python -m pytest -q

Licensed under the MIT License. Copyright © 2026 Tracy Anne Griffin Manning.

No registry listing or published package is claimed.