Ai Guardian MCP server
{
"mcpServers": {
"aiops-tools-ai-guardian": {
"command": "uvx",
"args": [
"ai-guardian-aiops"
],
"env": {
"AI_GUARDIAN_AIOPS_MASTER_PASSWORD": "<ai_guardian_aiops_master_password>"
}
}
}
}{
"mcpServers": {
"aiops-tools-ai-guardian": {
"command": "uvx",
"args": [
"ai-guardian-aiops"
],
"env": {
"AI_GUARDIAN_AIOPS_MASTER_PASSWORD": "<ai_guardian_aiops_master_password>"
}
}
}
}{
"mcpServers": {
"aiops-tools-ai-guardian": {
"command": "uvx",
"args": [
"ai-guardian-aiops"
],
"env": {
"AI_GUARDIAN_AIOPS_MASTER_PASSWORD": "<ai_guardian_aiops_master_password>"
}
}
}
}{
"servers": {
"aiops-tools-ai-guardian": {
"command": "uvx",
"args": [
"ai-guardian-aiops"
],
"env": {
"AI_GUARDIAN_AIOPS_MASTER_PASSWORD": "${input:ai_guardian_aiops_master_password}"
}
}
},
"inputs": [
{
"id": "ai_guardian_aiops_master_password",
"type": "promptString",
"description": "Ai guardian aiops master password",
"password": true
}
]
}{
"mcpServers": {
"aiops-tools-ai-guardian": {
"command": "uvx",
"args": [
"ai-guardian-aiops"
],
"env": {
"AI_GUARDIAN_AIOPS_MASTER_PASSWORD": "<ai_guardian_aiops_master_password>"
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall uvx ai-guardian-aiopsversion 0.10.0
What it does
AI Guardian exposes observability and governance tools for local LLMs running on Ollama, llama.cpp, LM Studio, or vLLM. It lets you audit which models are installed and running, scan prompts for secrets and PII before they reach the model, enforce model policies, and record interactions to a local audit log.
- Scan user prompts for secrets, PII, and jailbreak attempts before sending them to a local model, blocking high-risk content based on configurable thresholds.
- Audit which models are installed and running on an endpoint, check their provenance digests against a pinned list, and flag unauthorized models as disallowed.
- Route client traffic through a transparent proxy that applies the same prompt scanning, model policy checks, and audit logging to clients that don't explicitly opt in to governance.
Tools this server exposes
| Tool | Does |
|---|---|
| guarded_generate | Send a prompt through the scanner and policy gate; it scans for secrets and PII, checks the model against allow/deny policy, records the interaction, and calls |
| observe_chat | Chat completion variant of guarded_generate that applies the same scanning, policy checking, and audit recording. |
| proxy_guidance | Returns instructions for setting up and running the transparent capture proxy that inspects requests and streams responses while applying scan, policy, and reco |
| list_models | List all installed models from the configured runtime with their policy verdicts, provenance digests, VRAM residency, and metadata. |
| check_model_policy | Check whether a specific model is allowed or denied by the current policy rules. |
| scan_prompt | Scan a text string for secrets, PII, source leaks, and jailbreak signatures without sending it to a model; returns findings and risk band. |
| show_model | Retrieve details about a single model including license, parameters, capabilities, provenance digest, and policy verdict. |
| get_runtime_info | Return version, running processes, and state information from the configured local LLM runtime. |
| pull_model | Pull (download) a model into Ollama; not supported on OpenAI-compatible runtimes. |
| remove_model | Remove a model from Ollama; not supported on OpenAI-compatible runtimes. |
| unload_model | Unload a model from Ollama's VRAM; not supported on OpenAI-compatible runtimes. |
| audit_log | Query or export the local audit log of scanned prompts and model interactions from ~/.ai-guardian/usage.db. |
| verify_provenance | Check whether a model's current provenance digest matches a pinned digest to detect drift or tampering. |
| doctor | Run diagnostics on the configured runtime connection, policy setup, scanner, and audit logging across all supported runtimes. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.