Guard checks every tool call, file read, shell command, and MCP action against your policy before it runs.

•

Install Guard locally

•

Run one protected session

•

Review the first receipt

Blocks injected shell commands and secret reads before execution

Intercepts MCP tool calls and network calls that deviate from the task

Receipts show what was blocked, why, and what the agent was trying to do

Install Guard on the machine where your agent runs

Run one normal coding session

Open the receipt to see what Guard intercepted