Diogenes Agent Guardrails & Sandbox MCP server

• audit_mcp_server_manifestFree

  Scans an external MCP server's initial tools/list manifest to detect tool-name shadowing (read_file, bash) and hidden prompt-injection directives in descriptions. Use when vetting a newly discovered third-party MCP server before mounting it into an agent session; for comparing a previously pinned MCP baseline against a live mid-session tools/list response, use detect_mcp_schema_rugpull instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'manifest_json' ('audit_profile' defaults to 'strict'), supports '?demo=true' or L402 (25 sats), and returns HTTP 400 if invalid.

• audit_outbound_egress_urlFree

  Static validation firewall for outbound network destination URIs against cloud metadata IP addresses (169.254.169.254), RFC 1918 private IP blocks, and query-string secret exfiltration before agent dispatch. Use when validating a user-supplied or tool-supplied URI destination before network dispatch; for auditing local shell commands or general prompts, use verify_agent_command_safety instead. Read-only edge call (32 KB, 60 RPM): accepts 'destination_uri' ('egress_policy' defaults to 'block_private_and_metadata'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

• audit_response_factualityFree

  Cross-references factual claims, numbers, and citations in a draft agent response against retrieved source passages to flag unsupported hallucinations before delivery. Use when verifying that a generated answer is 100% grounded in source evidence before returning it to the user; for scrubbing inbound tool outputs for prompt-injection and invisible Unicode, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'claim' ('context' defaults to 'standard'), supports '?demo=true' or L402 (25 sats), and returns HTTP 400 if invalid.

• detect_agent_action_loopFree

  Analyzes an agent's recent tool-call trace to detect identical retry spins, A/B state oscillation, and runaway token burn. Use when monitoring autonomous agent execution loops to decide whether to continue or trip a token-burn breaker; for inspecting a single command payload for security threats before execution, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'action_trace_json' ('sensitivity' defaults to 'strict_2_repeats'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

• detect_mcp_schema_rugpullFree

  Computes structural diffs between a pinned baseline MCP tools/list snapshot and a live server response to catch mid-session description or schema tampering. Use when verifying that a connected MCP server has not mutated its tool definitions mid-session; for performing a first-time static security audit on a single MCP manifest, use audit_mcp_server_manifest instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'baseline_tools_json' ('current_tools_json' defaults to 'standard'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

• execute_python_sandboxwrite actionFree

  Audits Python source code for forbidden syscalls (os, subprocess, socket, open, eval) inside an AST-governed WebAssembly sandbox with no host filesystem access. Use when executing LLM-generated Python snippets safely; for checking shell commands without executing code, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'python_script' ('timeout_profile' defaults to 'fast_1s'), supports '?demo=true' or MPP (250 sats), and returns HTTP 400 if invalid.

• redact_sensitive_piiFree

  Redacts emails, phone numbers, SSNs, credit cards, API keys, and crypto private keys from text before logging or external transmission. Use when stripping personal data or secret credentials from prompts, logs, or outbound messages; for neutralizing indirect prompt injections and invisible Unicode in inbound tool responses, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'text' ('redaction_style' defaults to 'typed_token'), supports '?demo=true' or L402 (25 sats), and returns HTTP 400 if invalid.

• sanitize_tool_output_streamFree

  Sanitizes untrusted external tool or web-scrape outputs by stripping invisible Unicode Tag characters (U+E0000), neutralizing Markdown tracking image beacons, and defusing indirect prompt overrides. Use when cleaning raw third-party tool outputs or scraped web text before inserting it into the LLM context window; for redacting personal identifiable information (emails, SSNs, keys) from outbound text, use redact_sensitive_pii instead. Read-only edge call (32 KB, 60 RPM): accepts 'raw_tool_output' (with enum defaults), uses '?demo=true' or L402 (15 sats); HTTP 400 if invalid.

• validate_mcp_sampling_requestFree

  Audits inbound MCP sampling/createMessage callbacks from connected servers to block cross-server context snooping (includeContext='allServers') and token quota hijacking. Use when filtering a connected MCP server's request to sample the host LLM; for scrubbing text returned from a standard synchronous tools/call response, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'sampling_request_json' ('max_tokens_ceiling' defaults to '512'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

• validate_sql_query_astFree

  Performs static AST syntax tree parsing on SQL statements to verify strictly read-only SELECT clauses and reject mutations, stacked queries, or comment bypasses. Use when verifying that an agent-authored SQL statement is strictly read-only before running it on a database; for screening non-SQL bash commands or general agent prompts, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'sql_statement' ('dialect' defaults to 'postgres'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

• verify_a2a_agent_cardFree

  Verifies a remote agent's A2A /.well-known/agent.json discovery card, checking JWS/DID signature binding, endpoint HTTPS enforcement, and capability spoofing. Use when authenticating a peer autonomous agent before delegating subtasks or exchanging payments over A2A; for auditing an MCP tool server's tools/list manifest rather than a peer agent's A2A card, use audit_mcp_server_manifest instead. Read-only edge call (32 KB, 60 RPM): accepts 'agent_card_json' ('trust_policy' defaults to 'require_https_and_did'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

• verify_agent_command_safetyFree

  Evaluates untrusted agent prompts, bash commands, and tool arguments to block prompt injection, destructive shell commands, and private-key exfiltration. Use when screening a general shell command or user prompt before autonomous agent execution; for statically validating SQL database queries at the AST level, use validate_sql_query_ast instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'payload' ('action_type' defaults to 'bash_command'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 257ms20/20
• Tool poisoning12 tool descriptions checked15/15
• Auth qualityopen endpoint exposes 1 write-action tools with no auth3/15
• Maintenancelast push 0 days ago15/15
• Maintainer identityregistry namespace matches repository owner6/10

Safety score

79/100

higher than 58% of 4,464 AI and agents servers

Tools

12

the typical AI and agents server has 6

Tools that change things

8%

typical: 0%. Fewer write tools means less an agent can break

Uptime

96%

of our recent checks; the typical remote AI and agents server answers 100%

Response time

18 ms

faster than 97% of 2,333 AI and agents servers

GitHub stars

1

more than 50% of 2,697 AI and agents servers

Diogenes Agent Guardrails & Sandbox MCP: common questions

Is Diogenes Agent Guardrails & Sandbox MCP server safe?

Mostly: it is graded B (79/100). Read the Diogenes Agent Guardrails & Sandbox MCP safety report

How do I install Diogenes Agent Guardrails & Sandbox MCP?

It runs remotely at diogenes-micro-gateway.corinth.workers.dev. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does Diogenes Agent Guardrails & Sandbox MCP need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Diogenes Agent Guardrails & Sandbox MCP maintained?

The last commit was 7 days ago (2026-10-26). The latest release is v1.0.0.

Is Diogenes Agent Guardrails & Sandbox MCP up?

96% of our last 26 checks got an answer. We check remote servers about four times a day.

What can I use instead of Diogenes Agent Guardrails & Sandbox MCP?

Servers from other publishers that do the same job: LLM Sandbox MCP server, Agent-Native Analytics MCP server and Image MCP server.

How does Diogenes Agent Guardrails & Sandbox MCP compare with other AI and agents MCP servers?

safety score 79/100 (higher than 58% of 4,464 AI and agents servers); tools 12 (the typical AI and agents server has 6); tools that change things 8% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.