Open-source guardrail
Adding an MCP server to an agent
AgentTrail Guard asks you about this by default: you decide before the call runs. Where an agent cannot ask, the call is refused instead.
- Default action
- Ask
- Severity
- High severity
- Library version
- 0.2.1 · Sep 29, 2026
What it does
What it catches, and what it misses
Written into the rule itself, next to what it matches, so you can judge it before you trust it.
Holds the commands that register an MCP server with a coding agent — claude mcp add, claude mcp add-json, claude mcp add-from-claude-desktop, codex mcp add and gemini mcp add — and claude --mcp-config, which attaches servers to a single session. Each gives an agent a new set of tools, often a program fetched and started on the spot, with nobody reviewing the change. Deliberately NOT matched: listing or removing servers (claude mcp list, claude mcp remove), and the MCP Inspector (npx @modelcontextprotocol/inspector), which is a debugging tool rather than a registration. Cursor has no command for this, so its .cursor/mcp.json, in a project or the home directory, is matched as a file instead — written, not read: the Read and Grep tools never match it, and every other file tool does, including one this corpus does not know; a project's .mcp.json is held by fs.agent-self-config. Misses servers written into ~/.claude.json or Gemini's settings.json with a file tool, and a global flag whose value is quoted when it sits before mcp. A quoted MENTION is not a use: a search, a git commit -m message, an echo or a curl --data body that only names this command is left alone, as long as every shell metacharacter stays inside the quotes.
Examples
Tested on every build
The rule must match every command on the left and none on the right, or the library does not build. Catching the real thing is easy; staying quiet on the near-miss is the hard part.
Catches (10)
- claude mcp add --transport http docs https://docs.example.com/mcp
- claude mcp add github -- npx -y @modelcontextprotocol/server-github
- claude mcp add-json weather '{"type":"stdio","command":"weather-mcp"}'
- codex mcp add docs -- npx -y docs-mcp-server
- gemini mcp add filesystem npx -y @modelcontextprotocol/server-filesystem .
- claude --mcp-config ./servers.json -p "summarize the open issues"
- npx @anthropic-ai/claude-code mcp add docs https://docs.example.com/mcp
- PowerShellclaude mcp add --transport http docs https://docs.example.com/mcp
- Write.cursor/mcp.json
- Edit/Users/dev/.cursor/mcp.json
Stays quiet on (15)
- git commit -m "docs: explain claude mcp add --transport http docs https://docs.example.com/mcp"
- grep -rn "claude mcp add --transport http docs https://docs.example.com/mcp" docs/
- echo "never run claude mcp add --transport http docs https://docs.example.com/mcp"
- curl --data "we ran claude mcp add --transport http docs https://docs.example.com/mcp" https://api.example.com/comments
- claude mcp list
- claude mcp remove github
- claude mcp get github
- codex mcp list
- gemini mcp list
- npx @modelcontextprotocol/inspector
- Editconfig/mcp.json
- Edit.cursor/rules/style.mdc
- pnpm run test
- Read.cursor/mcp.json
- Grep/Users/dev/.cursor/mcp.json
In your agent
What "ask" means in each app
The guard runs as a hook in each app, and each app gives a hook different powers. Here is what this rule's default action does in each one.
- Claude Code
- You are asked before the call runs. If your settings.json already allows the tool outright, Claude Code runs it with no prompt.
- Cursor
- A terminal command that reaches the guard gets Cursor's approval card. Any other call that needs approval, such as a file edit or a read, is refused, because Cursor cannot ask there.
- Codex CLI
- Codex cannot ask, so the call is refused, and the reason says a person has to approve it.
This rule matches file paths. In Codex CLI, reading a file fires no hook, and in Cursor, reads shown as Explored are not checked, so there it sees fewer calls than in Claude Code. Each app hands the guard a different set of calls: in a Cursor sandbox run mode, for one, some terminal commands run without reaching the guard at all. Read the notes for Cursor and for Codex CLI before you rely on a rule there.
Make it yours
Change what it does in one command
Turn it off, change its action, or silence it on one command shape. The narrow one is allow: the rule keeps catching everything else.
Run it locally
Put these guardrails in front of your agent.
AgentTrail Guard is free and open source. It checks every command and file change against the whole library before your agent runs it, on your machine, with no account.
npm i -g @agenttrail/guard