Safe AI Agent — Guard Checks (free MCP server)
A free, read-only MCP server with three diagnostic tools for people who run AI agents in production. Distilled from the Safe AI Agent Pack — the production guard modules used by the Sage personal agent and the Growl AI marketing SaaS.
No network calls. No writes. Inputs that look like real secrets are refused.
Tools
| Tool | What it does |
|---|---|
audit_api_keys |
Flags over-privileged API keys from their permission descriptions (never pass key values — secret-looking entries are rejected, not stored) |
check_idempotency_pattern |
Scans a code snippet for the signals that actually stop duplicate execution: idempotency key, server-side store, uniqueness, short-circuit, payload binding, approval separation |
explain_guard_pattern |
Explains a production guard pattern — the failure it prevents and its minimal shape (idempotency_key, approval_gate, outbox, key_inventory, circuit_breaker, signed_approval_link) |
Install & run
git clone <this repo>
cd safe-agent-mcp
python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
.venv/bin/python safe_agent_mcp.py # stdio transport
Claude Desktop / Cursor MCP config:
{
"mcpServers": {
"safe-agent-guard-checks": {
"command": "/path/to/.venv/bin/python",
"args": ["/path/to/safe_agent_mcp.py"]
}
}
}
Test
.venv/bin/python test_server.py # in-memory client; calls every tool
The full pack
This free server is the diagnostic front door. The production modules —
SQLite idempotency store, @once decorator, approval outbox with HMAC-signed
approval links, the token-privilege inventory script, 18 regression tests and
the 100 production-traps catalog — ship in the
Safe AI Agent Pack ($69 / team $199).
License
MIT for this free server. The paid pack has its own commercial license.
1 maintainer
Metadata
1 maintainer
Release files for safe-agent-mcp 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| safe_agent_mcp-0.1.0.tar.gz | 7.3 kB | With provenance | Details for safe_agent_mcp-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| safe_agent_mcp-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for safe_agent_mcp-0.1.0-py3-none-any.whl |
Total release size: 14.6 kB
Release files / safe_agent_mcp-0.1.0.tar.gz
| Download URL | safe_agent_mcp-0.1.0.tar.gz |
|---|---|
| Size | 7.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
e88bcd65382615db649c9743b3e6ace90286b32763ca783deb2da8e7b1851a42
|
|
BLAKE2b-256 checksum How to use checksums |
8f72841ab1e790052331af13deede2242e733e772ce9c78f4a1cec8c584f356f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 29, 2026.
Transparency logRelease files / safe_agent_mcp-0.1.0-py3-none-any.whl
| Download URL | safe_agent_mcp-0.1.0-py3-none-any.whl |
|---|---|
| Size | 7.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
b0cdd1b4f41bae56e14341ce4ca2074616c9a2eb4f5d3afa4415539500fed73f
|
|
BLAKE2b-256 checksum How to use checksums |
985d50961256fa6d951aca7e3fa7ba42ab7dcb97a2aa3c639e5fdd9e01a3de98
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 29, 2026.
Transparency logSecurity for safe-agent-mcp 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for safe_agent_mcp-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 29, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
