Vizier Guard MCP server

<!-- mcp-name: io.github.vassiliylakhonin/vizier-guard -->

Vizier

Deterministic Authorization & Signed Audit Firewall for AI Agents.

Vizier is an ultra-fast, edge-native deterministic authorization and audit firewall for action-taking AI agents. Before an agent executes an external side effect (making a payment, executing code, modifying a database, dispatching messages, or deploying infrastructure), it submits the proposed action to Vizier.

⚡ Try the Live Interactive Playground: https://vizier.vassiliy-lakhonin.workers.dev/playground

Test policy presets (ALLOW, BLOCKAMOUNT, BLOCKTARGET, SENSITIVE), inspect sub-25ms edge latency, and verify SHA-256 canonical integrity and signed audit receipts in real time directly from your browser.

🏛️ Architecture

flowchart TD
    subgraph Agents["AI Agent Runtimes"]
        A1["Python Agent (LangChain / CrewAI / AutoGen)"]
        A2["MCP Client (Claude / Cursor / Tools)"]
        A3["TypeScript / Node.js Agent"]
    end

    subgraph Guards["Vizier Enforcement Boundary"]
        G1["@vizier_guard / Python SDK"]
        G2["@vizier/mcp-proxy CLI"]
        G3["@vizier/sdk (TypeScript)"]
    end

    subgraph Kernel["Cloudflare Workers Global Edge"]
        K["Vizier Deterministic Kernel (/v1/verify)"]
        P["Policy Engine: Limits, Targets, Roles, Grants"]
        D1["D1 Audit Ledger & Cryptographic Receipts"]
    end

    subgraph Targets["Protected External Side-Effects"]
        T1["Payment / Financial APIs"]
        T2["Database Writes & Deletions"]
        T3["Worker / Infrastructure Deployments"]
        T4["External Message Dispatch"]
    end

    A1 --> G1
    A2 --> G2
    A3 --> G3

    G1 -->|"POST /v1/verify"| K
    G2 -->|"POST /v1/verify"| K
    G3 -->|"POST /v1/verify"| K

    K --> P
    P --> D1

    G1 -.->|"Decision: ALLOW"| T1
    G2 -.->|"Decision: ALLOW"| T2
    G3 -.->|"Decision: ALLOW"| T3

    P -.->|"Decision: BLOCK / REVIEW"| G1
    P -.->|"Decision: BLOCK / REV

The decision path is strictly deterministic — no non-deterministic LLMs in the critical decision loop. It checks delegated actions, principal identity, amount limits, targets, sensitive operations, and authenticated integration boundaries. Every response includes policy results and a tamper-proof SHA-256 canonical receipt hash.

Status: experimental v0.4.0, deployed on Cloudflare Workers edge. Since v0.3.0, authority can be proved rather than asserted: a principal signs a delegation grant, Vizier verifies it against a registered public key, and the receipt records authority provenance. Read the threat model before placing this service in an execution path.

🌐 Public Surfaces

Shortened. The full README is on GitHub.