GoPlus AgentGuard

What it does

GoPlus AgentGuard is a security toolkit from GoPlus Security for coding agents such as Claude Code, Codex, OpenClaw and Hermes. Most of the package is a command-line tool (`agentguard`) that installs hooks into those agents. The same npm package also ships a separate stdio MCP server, the `agentguard-mcp` program, which exposes the checks as tools an assistant can call itself.

The MCP server has seven tools in version 1.2.1. One runs static analysis over a skill folder and reports a risk level with tags and evidence. Four manage a trust registry, a JSON file of skills marked untrusted, restricted or trusted, with optional allowlists for network, files, secrets and command execution. One takes a proposed action (network request, shell command, file read or write, secret access, Web3 transaction or signature) and returns allow, deny or confirm. The last checks a Web3 transaction against the GoPlus API before it is signed.

The README barely mentions the MCP server; it mostly covers the hooks, the CLI and the optional AgentGuard Cloud link, none of which this server uses. The server takes one option, `--registry-path`. Without it, the registry is kept at `~/.agentguard/registry.json`, or under `$AGENTGUARD_HOME` or `$OPENCLAW_STATE_DIR/agentguard` when those are set (src/registry/storage.ts at v1.2.1).

What it needs

Node.js 18 or later (the bundle manifest's stated runtime) on macOS, Linux or Windows. No account is needed for scanning, the registry or action decisions. Web3 transaction simulation needs a GoPlus API key and secret in GOPLUS_API_KEY and GOPLUS_API_SECRET.

Limits

Without GOPLUS_API_KEY and GOPLUS_API_SECRET, `action_scanner_simulate_web3` returns a result saying the GoPlus API is not configured instead of a simulation, and `action_scanner_decide` skips transaction simulation (src/action/index.ts). The server only advises: it returns decisions to the assistant and blocks nothing by itself; blocking comes from the separate hooks set up with `agentguard init`. `skill_scanner_scan` reads a local folder path only; scanning GitHub URLs, DSH plugins and the daily patrol are CLI features, not MCP tools. The npm latest is 1.2.1 while the main branch is at 1.2.2 betas.

Who it suits

Suits developers who want an assistant to vet a skill or plugin folder before installing it, or to ask for a policy decision on a risky command, file write or Web3 transaction, with everything kept on their own machine. Teams already in the GoPlus ecosystem get transaction simulation once they add API credentials. Anyone who wants risky actions actually stopped should install the AgentGuard hooks through its CLI instead of, or alongside, this server, since the MCP tools only report.