Screens an AI agent's tool calls before they run and tool results before the agent reads them. An MCP proxy plus a hooks adapter for a client's built-in tools.
A calibrated firewall for AI agent tool calls.
agent-chaperone screens an AI agent's tool calls before they run, and the tool results those calls return before the agent reads them. Every decision comes back as a probability, every threshold lives in a policy file rather than a prompt, and every judgment is written to a local log with the numbers that produced it.
It starts in shadow mode, which blocks nothing. You read your own log first and decide what you would have wanted stopped.
agentchaperone.dev carries the same material as pages, including the measured results and a guide for each way people set this up.
- Not a sandbox. It cannot stop a server from doing something the call did not describe. Pair it with OS-level isolation for that. - Not a replacement for the client's permission prompts. It is a second opinion that sees the content, which permission prompts do not. It never auto-approves anything on your behalf. - Not a guarantee. The underlying model does not treat its input as hostile by default, and adaptive attacks written against this tool will get through. The numbers below report what it catches and what it misses, including the misses. - Not local-only. Screening sends the arguments and results being screened to the configured model backend, so that content leaves the machine. Secret-shaped strings are redacted first, and screening can be turned off per server for content that has to stay local.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/agent-chaperone--agent-chaperone.html)
Security control plane for AI agents — identity and delegation, capability policy, data-flow taint and a live audit trail, enforced over MCP. Guards a real Claude Code end to end.
abhishekswe/agent-fastpathJev MCP server: a decision layer for coding agents, built on TypeSafe Jev (System One model). Ship gates, risk checks, file triage that keeps files out of context, and a safe headless browser, with ca
batrapulkit/squidbrakeBrakes for your AI agents: every tool call is checked against your rules, held for human approval when risky, and recorded in a tamper-evident audit trail. Works with Claude Code and any MCP app.
12122J/mcpvetMCP security scanner — vet a Model Context Protocol server before you add it to Claude Code, Cursor, or Windsurf. Grades it A–F, catching credential theft, tool-poisoning, and install-script payloads
VirajMishra1/bouncerIntent firewall for AI agents — NVIDIA Nemotron checks every tool call against the user's goal and blocks prompt-injection hijacks before they run.
PerryLink/jevcoreTypeSafe Jev for DeepSeek Harness, the Model Context Protocol, and plain Node: typed judgments instead of prose, offline by default.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.