prompt_guard and redact are the two that pair naturally with an agent — one screens what goes into the model, the other scrubs what comes out. The intelligence and embargo lookups turn an address, URL or hash into a verdict without leaving the thread, and log_entry writes the whole exchange to a verifiable trail.
A server over Pangea's security APIs, grouping AI Guard, threat intelligence, embargo screening, redaction, tamper-evident audit logging and Vault behind one tool set.
- prompt_guard — analyze and redact text to catch attempts to manipulate the model or smuggle content past it
- redact — strip sensitive information from text using defined rules
- lookup_domain_reputation and whois for domains
- lookup_ip_address_reputation, lookup_domain_from_ip_address, is_proxy, is_vpn and geolocate for IP addresses
- lookup_url_reputation for URLs and lookup_file_reputation for file hashes
- check_ip_embargo and check_iso_code_embargo against known sanction and trade-embargo lists
- log_entry and search_log against a tamper-evident audit log
- get_vault_item, list_vault_items, delete_vault_item and generate_key for secrets, tokens and cryptographic keys
A Pangea account with the relevant services enabled, and a token that reaches all of them stored in Pangea Vault. The server is given a Vault token, the identifier of the Vault item holding that service token, and an audit-log configuration id. Runs under Node, over stdio or as an HTTP server with Pangea's own authentication optionally in front of it.
One command plus a key — npx -y @pangeacyber/mcp-server, then supply credentials