io.github.stand-out-of-my-sun/diogenes-agent-guardrails-mcp

What it mainly works on, as our AI model read its tool descriptions: nothing outside itself: it only answers questions.

None of its 12 tools are described as changing anything. For 3 the reading was uncertain, so no mark is shown.

• verify_agent_command_safetyon 1 other serverreads or searches

  “Evaluates untrusted agent prompts, bash commands, and tool arguments to block prompt injection, destructive shell commands, and private-key exfiltration.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • payloadstringrequired“Raw command string, script snippet, or untrusted prompt to inspect for safety violations.”
  • action_typestring“Execution context of the payload; defaults to 'bash_command' when omitted.”
• validate_sql_query_aston 1 other serverreads or searches

  “Performs static AST syntax tree parsing on SQL statements to verify strictly read-only SELECT clauses and reject mutations, stacked queries, or comment bypasses.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • sql_statementstringrequired“SQL statement string to statically parse and audit for read-only SELECT compliance (e.g.”
  • dialectstring“SQL dialect ruleset used for AST token inspection; defaults to 'postgres' when omitted.”
• execute_python_sandboxon 1 other serverruns code or commands

  “Audits Python source code for forbidden syscalls (os, subprocess, socket, open, eval) inside an AST-governed WebAssembly sandbox with no host filesystem access.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • python_scriptstringrequired“Python 3 source script to audit and execute strictly inside an isolated AST-governed, non-privileged WebAssembly sandbox with no host filesystem access.”
  • timeout_profilestring“Execution resource ceiling; defaults to 'standard_5s' when omitted.”
• audit_mcp_server_manifeston 1 other serverreads or searches

  “Scans an external MCP server's initial tools/list manifest to detect tool-name shadowing (read_file, bash) and hidden prompt-injection directives in descriptions.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • manifest_jsonstringrequired“JSON string or object containing the external MCP server's tools array to audit.”
  • audit_profilestring“Sensitivity level for flagging system-tool name shadowing; defaults to 'strict' when omitted.”
• detect_mcp_schema_rugpullon 1 other serverreads or searches

  “Computes structural diffs between a pinned baseline MCP tools/list snapshot and a live server response to catch mid-session description or schema tampering.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  3 inputs, 1 required

  • baseline_tools_jsonstringrequired“JSON-serialized baseline tools/list array captured when the MCP server was first trusted.”
  • current_tools_jsonstring“JSON-serialized live tools/list array to compare against the baseline; defaults to '[]' when omitted.”
  • diff_modestring“Comparison strictness across descriptions and inputSchema; defaults to 'full_structural' when omitted.”
• validate_mcp_sampling_requeston 1 other serverreads or searches

  “Audits inbound MCP sampling/createMessage callbacks from connected servers to block cross-server context snooping (includeContext='allServers') and token quota hijacking.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • sampling_request_jsonstringrequired“JSON string or object representing the inbound MCP sampling/createMessage payload.”
  • max_tokens_ceilingstring“Maximum completion token quota allowed for server callbacks; defaults to '2048' when omitted.”
• sanitize_tool_output_streamon 1 other servercalculates or converts

  “Sanitizes untrusted external tool or web-scrape outputs by stripping invisible Unicode Tag characters (U+E0000), neutralizing Markdown tracking image beacons, and defusing indirect prompt overrides.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • raw_tool_outputstringrequired“Untrusted text returned by an external tool, webhook, or web scraper.”
  • wrap_tagstring“XML isolation wrapper applied around the sanitized text; defaults to 'tool_data' when omitted.”
• redact_sensitive_piion 1 other servercalculates or converts

  “Redacts emails, phone numbers, SSNs, credit cards, API keys, and crypto private keys from text before logging or external transmission.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • textstringrequired“Input text containing potential PII or secret keys to redact.”
  • redaction_stylestring“Placeholder format used for redacted spans; defaults to 'typed_token' when omitted.”
• detect_agent_action_loopon 1 other serverreads or searches

  “Analyzes an agent's recent tool-call trace to detect identical retry spins, A/B state oscillation, and runaway token burn.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • action_trace_jsonstringrequired“JSON-serialized array of recent agent actions (e.g.”
  • sensitivitystring“Cycle detection threshold; defaults to 'standard_3_repeats' when omitted.”
• verify_a2a_agent_cardon 2 other serversreads or searches

  “Verifies a remote agent's A2A /.well-known/agent.json discovery card, checking JWS/DID signature binding, endpoint HTTPS enforcement, and capability spoofing.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • agent_card_jsonstringrequired“JSON string or object of the peer agent's /.well-known/agent.json descriptor.”
  • trust_policystring“Verification policy for DID/DNS binding; defaults to 'require_https_and_did' when omitted.”
• audit_outbound_egress_urlon 1 other serverreads or searches

  “Static validation firewall for outbound network destination URIs against cloud metadata IP addresses (169.254.169.254), RFC 1918 private IP blocks, and query-string secret exfiltration before agent d…”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • destination_uristringrequired“Outbound HTTP/HTTPS destination URI to inspect before fetching (e.g.”
  • egress_policystring“Network egress policy; defaults to 'block_private_and_metadata' when omitted.”
• audit_response_factualityon 1 other serverreads or searches

  “Cross-references factual claims, numbers, and citations in a draft agent response against retrieved source passages to flag unsupported hallucinations before delivery.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  3 inputs, 2 required

  • claimstringrequired“Draft agent response or factual statement to verify for hallucinations.”
  • contextstringrequired“Authoritative source text or retrieved RAG passages that the claim must be grounded in.”
  • strictnessstring“Entailment threshold required for numbers and dates; defaults to 'exact_entailment' when omitted.”

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-23.

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.