Six public tools
for your assistant

Exactly six tools

Every tool has an IP rate limit. Trial requests also keep the website's one-trial-per-email limit. A shared network or an assistant provider's shared outgoing IP can share a limit. Wait before retrying a rate-limited call.

Receipt verification allows 60 requests per minute per IP, and documentation questions allow 10. These two limits share the existing website handlers' in-memory counters within each running server instance; they are not a global allowance across instances. Trial issuance allows five new trials per IP per UTC day through the existing shared trial store. The MCP endpoint also limits each IP to 120 requests per minute per instance, including discovery and repeated trial requests.

The three checks use the website's shared rate limit store. A setup check of pasted files allows 30 per minute per IP. A setup check of a public repo shares the website harness check's limit of 10 per minute per IP, and drops to 3 per minute per instance if that store is down. The template score shares the website's limit of 30 per minute per IP, and the payment risk check shares its limit of 10 per minute per IP. The payment risk scoring service can also answer that it is busy; wait a minute and retry.

There are no other tools or MCP resources. The server does not provide account, billing, license lookup or customer-data access. Trial requests use the existing issuance and email flow.

Claude and Claude Code

In Claude, open Customize > Connectors, select the plus button, then Add custom connector. Enter this name and URL:

Name: AgentGuard
Remote MCP server URL: https://agentguard.run/api/mcp

No OAuth credentials are needed. Add the connector, then enable it in the conversation's connectors menu. For a Team or Enterprise workspace, an owner first adds it under Organization settings > Connectors > Add > Custom > Web. Account and workspace rules can limit which connectors you can add.

For Claude Code, run these exact commands in your terminal:

claude mcp add --transport http agentguard https://agentguard.run/api/mcp
claude mcp get agentguard

The command uses Claude Code's default local scope. Use /mcp inside Claude Code to inspect the connection and tools. Claude's hosted connector connects from Anthropic's servers; Claude Code's direct HTTP configuration is a separate connection.

Setup checked on September 21, 2026 against the official Claude custom connector guide and Claude Code MCP reference.

ChatGPT

1. Open Settings > Security and login and enable Developer mode. Availability depends on your account and workspace policy.
2. Open ChatGPT Plugins and select the plus button.
3. Enter the fields below. Under Connection, choose a public endpoint. No authentication credentials are needed.
4. Create the connection and review the six discovered tools. Start a new conversation and add the connection from the tools menu.

Name: AgentGuard
Description: Receipt verification, trial requests, AgentGuard documentation, a coding-agent setup check, a Grok Bot template score and a payment risk estimate.
MCP server URL: https://agentguard.run/api/mcp

ChatGPT uses these connection fields, not a local JSON configuration file. If you change the server's tools, refresh the connection metadata before starting a new conversation.

Setup checked on September 21, 2026 against OpenAI's Connect and test your plugin guide.

Cursor

Add this entry to .cursor/mcp.json in your project, or ~/.cursor/mcp.json for your personal configuration. Preserve any other server entries already in the file.

{
  "mcpServers": {
    "agentguard": {
      "url": "https://agentguard.run/api/mcp"
    }
  }
}

Open Cursor's Customize page to inspect the server. No authorization headers are required. Team allowlists can still restrict remote servers.

Setup checked on September 21, 2026 against the official Cursor MCP reference.

Try a call

Ask your assistant to call ask_docs with:

{"question":"How does your refund policy work?"}

To request your trial email, ask it to call start_trial with your own address. This action sends an email if you are eligible:

{"email":"you@example.com"}

For verify_receipt, put your receipt JSON object or decision-chain array in the receipt field. An object can also contain the public verifier's chain, entries or dag wrapper. Include publicKeyHex when the decision-chain verifier needs your public key. Use a public key only. Never submit a signing key.

To check a coding-agent setup, ask it to call check_setup with the files you choose to share, using their real repo paths. Leave secret values out:

{"files":[{"path":".claude/settings.json","content":"{\"permissions\":{\"allow\":[\"Bash\"]}}"}]}

Or give it a public repo:

{"repo":"owner/repo"}

For score_template, put the template text you copied from Grok Bot in the text field. For payment_risk_check, pass the answers as option ids:

{"industry":"saas","monthly_transactions":"500-2000","total_disputes":"1-5","fraud_disputes":"0","region":"US","fraud_tools":["3ds","cvv"]}

Tool results preserve the website handler's JSON in structuredContent, with its HTTP status in _meta.httpStatus. A rejected request is marked isError; the result explains the failure.

What you choose to send

The receipt, question or email you submit to a hosted tool is sent to AgentGuard's server, and so are the files, template text and answers you send to the three checks. This is separate from the local plugin, which does not forward its tool traffic here.

Receipt verification uses the existing public verifier. Its log records the supplied receipt identifier, a hash of the connecting IP, client metadata and the verification result. The receipt payload itself is not included in that verification log.

Documentation questions use the same service as the website's help chat. A question outside the fixed answers may be sent to the guarded help model. A question that needs review can be forwarded to the support team through the existing escalation flow.

The setup check runs the published harness rules on AgentGuard's server. Pasted files are checked in memory and are not stored, logged or counted. On the website page the same rules run in your browser instead, so pasted files never leave it there. For a public repo, AgentGuard's server reads the repo's agent configuration through the GitHub API, does not store it, and records one count with no identifier: the tool, the result band and the day. A public repo result can include a signed share link that carries the score and rule ids, never a file.

The template score runs the published rules on AgentGuard's server. The text is scored in memory and is not stored or logged; one count with no identifier records the grade and the day. No share link is created and no template link is opened.

The payment risk check sends your multiple-choice answers to AgentGuard's server, which checks them against the published options and forwards only those answers to MerchantGuard's scoring service at merchantguard.ai to compute the estimate. No name, email or free text is accepted. AgentGuard does not store the answers and records one count with no identifier: the band and the day. The scoring service may send our team a notice with the resulting score, tier and industry, with no identifier for you.

Trial requests use your email to apply the existing trial limits and send the trial email. Do not include customer information, prompts, private files, credentials or signing keys in tool arguments.

Read What leaves your machine for the plugin's network inventory and the privacy policy for the website's services.

Discovery and connection checks

A regular GET to /api/mcp returns a short JSON description and the tool list. The discovery document is /.well-known/mcp.json. Tool calls use the MCP client transport; opening the URL in a browser does not call a tool.

Use a client that supports Streamable HTTP. The hosted service does not need a bearer token, does not offer a legacy SSE endpoint and does not provide a persistent notification stream.

Built against the 2026-07-28 transport specification with the official TypeScript SDK 2.0.0. The SDK also serves stateless 2025 Streamable HTTP clients. The discovery JSON is a site description, not a separate MCP protocol standard.