Guard MCP server

@codapult/guard

Architecture guardrails for AI coding agents

@codapult/guard is a local-first, model-agnostic architecture guard for JavaScript and TypeScript projects.

It learns what already exists, records the project’s architectural memory, and can protect future changes from introducing regressions covered by the project’s approved policy.

See the value in one change

Suppose a SaaS project has an established boundary:

Client → Server Action → Service → Repository → Database

An AI agent can still produce code that is valid TypeScript but crosses that boundary:

Client → Database

After the project has explicitly approved a matching import rule or deterministic contract, Guard checks the changed files and reports matching violations deterministically:

Codapult Guard (changed files)
Scanned 1 source file(s); suppressed 12 baseline finding(s).

src/app/settings/page.tsx:1 [client-no-persistence-import]
  Client modules should not import persistence-layer modules.
  import: @/lib/db/client

✗ 1 issue(s) found
Exit code: 1

The file path, rule ID, message, and counts depend on the project. This is the actual CLI output shape: Guard does not infer that every Client → Database edge is forbidden, and it does not activate proposals silently. The team approves the relevant policy first; then existing findings can be baselined while newly matching violations fail the gate and give the agent bounded evidence to repair.

Guard does not tell every project to use the same architecture.

It discovers the architecture that is already there, then lets the team decide what becomes policy.

The core is universal. The strongest first-class scenarios are Next.js SaaS and AI-assisted development, including server/client boundaries, routes, persistence, authentication, billing, background jobs, environment configuration, and AI integrations.

Part of the Codapult ecosystem

Guard is an independent open-source project from Codapult. It does not require Codapult and can be installed in any JavaScript or TypeScript repository.

The relationship is complementary:

Use standalone Guard for any compatible project. Use the Codapult CLI when working on a Codapult SaaS project and you want project management, database, plugins, deployment, MCP, and Guard in one CLI.

Shortened. The full README is on GitHub.