Security & governance guardrails for MCP agents in Java — audit trail, agent-to-tool authorization, prompt-injection detection and rate limiting as a zero-config Spring Boot starter.
MCP Agent Guardrails helps you put security and governance controls around MCP tool calls in Java / Spring Boot applications with absolute minimum fuss. Every tool invocation runs through a chain of guardrails — audit, authorization, prompt-injection detection and rate limiting — before the tool executes.
When you expose MCP tools to LLM agents, the "client" is a model deciding on its own what to invoke and with which arguments. This project closes the four gaps that opens.
Work with zero configuration: add one dependency and all four guardrails are active with sensible in-memory defaults. Be opinionated, but get out of the way: every store, policy source and rule set is a port — expose your own bean and the default backs off. Fail closed: a guardrail that throws denies the call rather than passing it. The one deliberate exception is recording the decision trace — a broken audit store degrades observability, never protection, because a store that could block calls would be a single point of failure for the whole server. Never persist tool arguments (PII/secret risk) — audit trails carry metadata only.
Module Description ------ guardrails-core Shared model, Guardrail and ResultGuardrail SPIs, inbound and outbound chains, and the MCP tool-call interceptor guardrails-audit Audit trail of every invocation, every guardrail decision, both chains and every human approval guardrails-authz Declarative agent→tool authorization policy (first-match-wins rules) guardrails-injection-guard Rule-based prompt-injection detection over tool arguments guardrails-ratelimit Fixed-window rate
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/TikyParkinson--mcp-agent-guardrails-spring-boot-starter.html)
Privacy guardrails for Spring AI: request-scoped PII tokenization and least-privilege disclosure across model/tool calls, with Presidio and JVM-local OpenNLP.
Matthew0822/MCPBastionZero-trust security gateway between AI agents and MCP servers: scoped capabilities, redaction, rate and cost limits, and verifiable session logs.
agent-chaperone/agent-chaperoneScreens an AI agent's tool calls before they run and tool results before the agent reads them. An MCP proxy plus a hooks adapter for a client's built-in tools.
batrapulkit/squidbrakeBrakes for your AI agents: every tool call is checked against your rules, held for human approval when risky, and recorded in a tamper-evident audit trail. Works with Claude Code and any MCP app.
VirajMishra1/bouncerIntent firewall for AI agents — NVIDIA Nemotron checks every tool call against the user's goal and blocks prompt-injection hijacks before they run.
flankerhqd/cyvisguardSecurity control plane for AI agents — identity and delegation, capability policy, data-flow taint and a live audit trail, enforced over MCP. Guards a real Claude Code end to end.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.