MCP guard

getclaros guard sits in front of an MCP server, local (stdio) or remote (HTTP). Reads pass through. Each write tool call goes to POST /v1/check first; a call that breaks a rule is never forwarded, and the agent gets a tool error with the rule, the owner’s words and who to ask. Your agent doesn’t change.

Set up

npx getclaros          # init and setup: the same

Signs you in through the browser (device sign-in) and saves an agent key for the workspace you pick.
Finds your agent clients’ MCP configs and lists their servers.
Wraps every server it can (reads pass straight through, so guarding a read-only server costs nothing), after backing up the file. --servers a,b narrows it; Enter at the prompt takes all, p picks.
Adds a claros entry so agents can read the map up front (MCP server).

Restart the agent client afterwards.

Flag
`--key clr_…` / `$CLAROS_KEY` / `--key-stdin`	Use this key instead of signing in (`--key-stdin` keeps it out of argv and the environment)
`--paste`	Paste a key (hidden) instead of signing in
`--no-browser`	Print the sign-in URL, don’t open it
`--server <claros>` / `--url`	Claros server base URL
`--web <origin>`	The web app to ask for the server address (default `https://claros.sh`)
`--yes`	Guard everything found, no questions
`--json`	The result as JSON on stdout (scripted setup)
`--project-hooks`	Coding-agent hooks in this project only (default: every project on this machine)
`--servers a,b`	Pick servers by name
`--project <dir>`	Where project configs are read (default: current directory)
`--no-mcp`	Don’t add the `claros` entry

Client	Files read
Claude Code	`<project>/.mcp.json`, `~/.claude.json` (incl. per-project servers)
Claude Desktop	`claude_desktop_config.json`
Cursor	`~/.cursor/mcp.json`, `<project>/.cursor/mcp.json`
VS Code	the profile’s `mcp.json`, `<project>/.vscode/mcp.json`
Codex	`~/.codex/config.toml`, `<project>/.codex/config.toml`

init only edits files that exist. Each wrapped server’s command becomes npx -y getclaros guard --server <name> -- <original command>; env, cwd and comments stay. Running it again changes nothing.

Check it: `test`, `status`

npx getclaros test              # a record that breaks one of your rules → the stop; nothing reaches the app
npx getclaros test --app crm    # use the map for one guarded server
npx getclaros status            # per agent: guarded, not guarded, or changed since setup; Claros reachable, key valid (doctor: the same)

Exit codes: 0 stopped (test) / OK (status), 1 not stopped, no map to test, or (status) an agent not guarded or changed since setup, or a browser agent here not set up, 2 not signed in or bad usage, 3 Claros unreachable or key rejected. With no guarded server matching a map, test uses your newest map and says DEMO.

Undo

npx getclaros undo        # the last init
npx getclaros undo --all  # every init, plus any guard wrapping it finds

A file still exactly as init wrote it is restored from its backup. A file you changed since is unwrapped in place, keeping your edits.

Run it by hand

export CLAROS_KEY=clr_...
getclaros guard --server crm -- npx -y mcp-sqlite /path/to/crm.db

Flag	Default
`--server <name>`	required	Sent as `app`; used for routing and tool mappings
`--url <base>`	`$CLAROS_URL`, the saved URL, else the one the web app names at `/.well-known/claros.json`	If the saved server stops answering, the web app is asked again
`--web <origin>`	`$CLAROS_WEB`, the saved origin, else `https://claros.sh`
`--key <key>`	`$CLAROS_KEY`, else the saved key	Prefer the env var: flags show in process lists
`--timeout <ms>`	`5000`	Per check, including record reads
`--fail-open`	off	Forward writes when Claros can’t be reached
`--ask-wait <s>`	`120`	On an ask, wait this long for the rule owner’s answer; forward only an approval of this exact call (`0`: don’t wait). See Asks
`--remote <url>`		A remote MCP server instead of `-- <command>` (Remote servers)
`--header "K: V"`		Sent to the remote server only; repeatable

The guard logs one line per decision on stderr:

[getclaros guard] crm create_record → stop wf_sales_discounts g3 612ms chk_0b14cb5eef

Remote servers

Hosted MCP servers (a url entry instead of a command) are guarded too. Your client still starts a local process; the guard reaches the server over Streamable HTTP:

getclaros guard --server linear --remote https://mcp.linear.app/mcp --header "Authorization: Bearer $LINEAR_TOKEN"

init does this for you when the entry has static headers (headers, or http_headers in Codex): the entry becomes npx -y getclaros guard --server <name> --remote <url> --header "K: V" …. The headers stay in that same config file (${VAR} and ${input:…} still work) and go only to the app’s server, never to Claros. undo puts the url entry back. Listed but not guarded yet:

Servers that sign in with OAuth (no static header in the config).
A token from an env var or a helper (Codex bearer_token_env_var / env_http_headers, Claude Code headersHelper).
Legacy SSE servers ("type": "sse").

Limits

Remote servers: static headers and Streamable HTTP only (see above).
Codex servers written as inline tables or dotted keys aren’t found.
No Windows .cmd shims.

Get started

Rules

Checking

Evidence

Guard

Accounts

Security

Changelog

Set up

Check it: `test`, `status`

Undo

Run it by hand

Remote servers

Limits

​Set up

​Check it: test, status

​Undo

​Run it by hand

​Remote servers

​Limits

Set up

Check it: `test`, `status`

Undo

Run it by hand

Remote servers

Limits