Skip to main content

Unveilr Guard

See what your AI coding agents can access — and stop dangerous supported actions before they run.

unveilr scan                                 # what agents and MCP servers exist here
unveilr .                                    # what AI-SDLC risk is in this repository
unveilr proxy --server <id> -- <command>     # shield a local MCP server

Open source, AGPL-3.0-only. It works entirely offline: no account, no telemetry, and nothing leaves your machine unless you explicitly ask it to.

The three things it does​

Discover — fingerprint the coding agents installed on this machine and the MCP servers they are configured to reach. Credential values are never read, printed, logged or stored; the flag name survives so that "this server holds an API key" remains visible, and the value is replaced with [REDACTED] before it leaves the process.

Inspect — run detectors over a repository and report findings with a stable rule ID, a severity, and the message explaining it. Gate CI on the result with --fail-on.

Guard — a local MCP gateway that evaluates each tool call against your policy before forwarding it upstream, and refuses the ones your policy denies.

What makes this worth reading​

Most teams cannot answer three questions about the agents already running on their developers' laptops:

  • how many agents do we have?
  • what can they reach?
  • who owns them?

An agent typically runs with a cloud identity that can assume other roles, MCP servers rooted above the project directory, a shell, and long-lived keys sitting in ~/.aws. Unveilr Guard answers those questions from the machine the agents run on, explains why a path is dangerous, and — where it sits authoritatively in the call path — refuses the action.

What it does not do​

Read Limitations before you deploy this. Runtime enforcement is adapter-specific: Unveilr Guard blocks actions on paths where it sits authoritatively, today the MCP gateway, and it does not intercept everything an agent does. A local guard can be bypassed by any process that does not route through its interception path.

Those constraints are on the site's main navigation rather than in an appendix, because they are what determines whether this tool fits your threat model.

Status​

Pre-1.0. Schemas are versioned v1alpha1 and may change before 1.0. Breaking changes are documented.

Which product is this?​

This site documents the open-source CLI. The commercial control plane — organisation-wide identity graph, cross-workstation correlation, central approvals, distributed enforcement — is a different product with its own documentation. See Open source vs Enterprise for where the line falls and why.