The profile ladder is the practical part: run `monitor` to see what your agents actually do, move to `balanced`, and reserve `strict` for the systems where a wrong call costs something. The project is explicit about what its safe zones are not — path-boundary checks, not OS sandboxing or container isolation — so pair it with real isolation rather than treating it as a replacement, and keep the native `vanguard_*` management tools disabled or operator-only in production.
A security gateway for MCP traffic. It wraps an existing stdio server, or runs as a hosted gateway over SSE and Streamable HTTP, and inspects each tool call before it reaches the tool underneath. Existing servers do not need rewriting; you point the gateway at the command you were already launching. Three profiles — `monitor`, `balanced`, `strict` — let you start in audit-only mode and tighten later.
- Every call run through five inspection layers before it is forwarded: `L0` preflight normalisation (URL decode, NFKC, zero-width stripping, size and depth gates), `L1` deterministic rule matching, `L1.5` trust-signal camouflage detection, `L2` optional semantic intent scoring, `L3` session and sequence anomaly checks
- A final verdict per call from the policy composer — ALLOW, WARN, REVIEW, SHADOW-BLOCK or BLOCK — with the blocked call returned to the agent as a standard JSON-RPC error the upstream server never sees
- Metadata poisoning inspection on `initialize` and `tools/list`, so a hostile tool description is caught before the model reads it
- Deterministic path-boundary checks over path-like arguments, tuned in `rules/safe_zones.yaml` for the directories your tools may touch
- JSON audit logs with SIEM-friendly decision fields and a `policy_explanation` block naming the layer, rule family, profile effect, upstream-call status and a tuning hint
- A local dashboard, a compliance check and packaged benchmark corpora you can run per profile — `vanguard ui --port 4040`, `vanguard audit-compliance`, `vanguard benchmark-run --profile monitor`
Python 3.11+ and `pip install mcp-vanguard`; extras add Redis-backed multi-instance behavioural state, RE2 regex matching, or the full hosted deployment. Local use needs no network auth — `vanguard start --profile balanced --server "..."` wraps the server you name. Hosted use does: the `strict` profile refuses to start on a public bind without transport auth, meaning a long random `VANGUARD_API_KEY` or OAuth/JWKS settings, and `balanced` will warn loudly instead. If you run a shared gateway, set `VANGUARD_ALLOWED_SERVER_COMMANDS` to restrict which upstream executables it may spawn. The optional semantic layer takes a backend key — `VANGUARD_OPENAI_API_KEY`, `VANGUARD_SEMANTIC_CUSTOM_KEY`, or `VANGUARD_OLLAMA_URL` for a local model with no key at all.
One command — pip install mcp-vanguard