Correction, July 26, 2026: the runs below prove real SDK verdicts and receipts. They do not prove mandatory interception of every Buzz action. MCP alone does not force the host to consult the decision tool.
Where the seam is
Buzz built authorization and authorship. An agent has an identity, an owner can grant it a narrowly scoped authorization, that grant is cryptographic and revocable, and every action is signed so authorship survives delegation. That is genuine trust infrastructure, and it is not the part that is missing. What Buzz does not yet do is enforce a policy on the economics of an action while it happens: there is no spend cap, no capability ceiling, no runtime refusal when a call would cross a budget or a tier, and no signed receipt of that decision as a product surface. Authorization says who may act. Accounting records what it cost. Between those two sits enforcement, and that is the seam AgentGuard fills.
Buzz built authorization and authorship. AgentGuard is the enforcement between them.
The plug-in point is already there
The buzz-acp harness (the adapter that runs Goose, Codex, or Claude as Buzz agents) exposes an optional MCP server to the agent through one env var, BUZZ_ACP_MCP_COMMAND. Point it at AgentGuard and the agent sees the spend and action gate as regular MCP tools. No fork, no patch, no new event kind.
One real detail: the harness forwards that value as a single command with no arguments, so a multi-word npx line will not spawn as-is. Wrap it in a one-line launcher. That is a wrapper script, not a change to Buzz.
Setup
First use Buzz's buzz-admin mint-token command to create the bounded-agent identity with message-read, message-write, and channel-read scopes. Then create the launcher below.
#!/usr/bin/env bash
exec npx -y @agentguard-run/mcp
# point buzz-acp at it, then run the agent as usual
export BUZZ_ACP_MCP_COMMAND="$PWD/agentguard-mcp.sh"
The MCP server can apply a configured five dollar per-day cap to metadata Buzz chooses to submit through spend_decide. The current MCP tool has no capability input and does not force other Buzz decisions through the gate.
Three SDK reference decisions
An owner can authorize an agent to transact. Enforcement is the separate question of whether a specific call is within budget and capability policy. These are captured Spend SDK decisions that demonstrate the underlying engine; they are not intercepted Buzz dispatches.
Verify it yourself
Each decision signs a receipt into a hash-linked chain that verifies offline. Turn a refusal into an allow and verification fails at that exact entry.
✓ full chain valid ✓ signatures match ✓ no sequence gaps
What the reference chain records
- source
- Spend SDK reference run
- cap
- $5.00 / day
- ceiling
- read_only in SDK policy
- receipts
- seq 0 to 2, chain valid
Reproduce the AgentGuard side with the supplied local Spend and MCP trees, whose source is provided under the checked-in Alpha License. The external Buzz project was not checked in this local audit. Start with the local test and setup paths, try the same three actions in the homepage playground, or reach us at [email protected].