Runtime Guard & MCP Proxy

AgentShield's real-time interception proxy validates tool calls, enforces parameter allowlists, and strips sensitive data from outgoing responses.

1. Remote HTTP / SSE MCP Proxy

Place AgentShield in front of remote or containerized MCP HTTP/SSE endpoints. It inspects all JSON-RPC tools/call messages, blocks policy violations, and redacts leaked credentials from streaming responses.

# Start reverse-proxy listening on localhost:8080 forwarding to remote server
agentshield guard --listen 127.0.0.1:8080 --target http://127.0.0.1:3000

# With policy enforcement threshold:
agentshield guard --listen 127.0.0.1:8080 --target http://127.0.0.1:3000 --fail-on block

2. Stdio MCP Process Wrapper

Bridge local stdio MCP processes directly into Claude Desktop or coding agents while enforcing runtime guard invariants:

# Bridge stdio process
agentshield guard --mcp-proxy -- npx -y @modelcontextprotocol/server-postgres "postgresql://..."

3. Egress Policy Enforcement

Automatically generate network egress allowlists based on static tool scans, then lock outbound traffic with agentshield wrap:

# 1. Generate egress policy from static scan
agentshield scan . --emit-egress-policy agentshield.egress.toml

# 2. Run agent execution wrapped by local egress proxy
agentshield wrap --policy agentshield.egress.toml -- python agent_worker.py