AI Guardian

Governed local-LLM observability: model policy, prompt scanner, capture proxy, 21 tools.

Connector by AIops-tools · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)

Chalk Labs

Need help deploying AI Guardian?

Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.

Book a call

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/aiops-tools-ai-guardian

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Governed local-LLM observability: model policy, prompt scanner, capture proxy, 21 tools.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools: 12 read · 7 write · 1 delete · 1 not yet classified
Secrets: None asked for
Install scripts: None found
Runs as: Python package

Tools by what they do 21

Read from the source code; the running server may list different tools.

Read 12 · Look things up without changing anything.

anomaly_report
list_models
model_details
model_provenance
policy_view
proxy_guidance
running_models
scan_prompt
server_status
undo_list
usage_events
vram_usage

Write 7 · Create, change, send or run things.

guarded_generate
pin_model_digest
pull_model
set_model_allowlist
set_model_denylist
undo_apply
unload_model

Delete 1 · Delete, drop, revoke or wipe things.

remove_model

Not yet classified 1 · We could not tell from the name and description.

observe_chat

Network hosts it talks to 3

anthropic.com · found in code
github.com · found in code
glama.ai · found in code

Files it touches

~/.ai-guardian
~/.ai-guardian/audit.db
~/.ai-guardian/config.yaml
~/.ai-guardian/secrets.enc
~/.ai-guardian/undo.db

Tools (21)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

anomaly_report
[READ] Rollup: shadow models, digest drift, high-risk prompts, blocked count. Args: target: Ollama target name from config; omit for the default.
guarded_generate
[WRITE][risk=medium] Scan + policy-gate a prompt, record it, then run if allowed. The route-through guard: scans the prompt (secrets/PII/code/jailbreak), checks the model against policy, blocks if the risk band >= block_threshold or the model is disallowed, records the interaction to the usage log, and only calls Ollama if allowed. The raw prompt is never stored. Args: model: Model to run. prompt: The prompt text (scanned before any model call). agent / user: Actor attribution recorded in the usage log. block_threshold: Block when risk band >= this (none/low/medium/high/criti…
list_models
[READ] Installed models, each annotated with the allow/deny policy verdict. Shadow (unsanctioned) models show ``allowed: false``. Args: target: Ollama target name from config; omit for the default (local).
model_details
[READ] License / parameters / capabilities for one model. Args: model: Model name (e.g. "llama3.2:3b"). target: Ollama target name from config; omit for the default.
model_provenance
[READ] Compare each installed model's digest against its pin; flag drift. Args: target: Ollama target name from config; omit for the default.
observe_chat
[WRITE][risk=medium] Scan + policy-gate a chat exchange, record it, then run if allowed. Args: model: Model to run. messages: OpenAI-style [{"role","content"}] messages (contents are scanned). agent / user: Actor attribution recorded in the usage log. block_threshold: Block when risk band >= this. target: Ollama target name from config; omit for the default.
pin_model_digest
[WRITE][risk=medium] Pin a model's expected provenance digest (drift detection). Args: model: Model name. digest: The expected digest to pin (from list_models / model_details).
policy_view
[READ] The current model allow/deny policy + provenance digest pins.
proxy_guidance
[READ] How to run the transparent capture proxy, and what it does NOT guarantee. WRITES NOTHING and starts no listener — it composes the `ai-guardian proxy serve` command plus the client-side change, and returns the caveat that matters: the proxy is a CHOKEPOINT, not an enforcement boundary. Any client that can still reach the runtime's real port bypasses it entirely, and this tool cannot detect that. Captured traffic is a sample, not the population, until the runtime is unreachable except through the proxy. Requests are scanned before forwarding; responses stream through uninspected, becaus…
pull_model
[WRITE][risk=medium] Pull a model — refused if it violates the deny/allow policy. Args: model: Model name to pull. target: Ollama target name from config; omit for the default.
remove_model
[WRITE][risk=high] Delete a local model. Destructive — pass dry_run=True to preview. Captures the model's manifest so the harness records an undo (re-pull). An undo is recorded only when the allow/deny policy would permit re-pulling the model. For a denied one the result says reversible=false and explains why, rather than recording a re-pull that undo_apply is bound to refuse. The dry-run preview carries the same verdict, so the caller learns it before the deletion rather than after. Args: model: Model name to delete. dry_run: If True, return what WOULD be deleted without deleting. …
running_models
[READ] Currently loaded models: VRAM footprint + residency expiry. Args: target: Ollama target name from config; omit for the default.
scan_prompt
[READ] Pure content scan of a text for secrets / PII / code / jailbreak. No Ollama call — a deterministic scan returning findings + a weighted risk band. Use it to pre-check anything before sending it to a local model. Args: text: The text to scan.
server_status
[READ] Ollama reachability + version. Args: target: Ollama target name from config; omit for the default.
set_model_allowlist
[WRITE][risk=medium] Replace the model allowlist (glob patterns; empty = allow-all). Args: models: Shell-glob patterns of permitted model names (e.g. ["llama3.*", "qwen*"]).

Show 6 more tools

set_model_denylist
[WRITE][risk=medium] Replace the model denylist (deny patterns always win). Args: models: Shell-glob patterns of forbidden model names.
undo_apply
[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool. The inverse runs through its own governed tool, so its real risk tier is recorded there. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once. Args: undo_id: The undoId from undo_list (or an ``_undo_id`` in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.
undo_list
[READ] List recorded, not-yet-applied undo tokens (most recent first). Each entry names the original tool, the inverse tool that ``undo_apply`` would run, and a human note. Use the ``undoId`` with ``undo_apply``. Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. ``truncated`` is *measured* (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher ``limit`` rather than reporting the list as complete. Each entry carries ``effectVerified``. False means the original write lost its response, …
unload_model
[WRITE][risk=medium] Evict a model from VRAM (keep_alive:0). Args: model: Model name to unload. target: Ollama target name from config; omit for the default.
usage_events
[READ] Query the observed-usage log (route-through prompts + their findings). Args: model: Filter by model name. risk_level: Filter by risk band (none/low/medium/high/critical). allowed: True = only allowed calls; False = only blocked. since: ISO start timestamp. limit: Max rows. Returns ``{"events": [...], "count": N, "returned": N, "limit": L, "truncated": bool}``. When ``truncated`` is true more prompts were observed than were returned — raise the limit or narrow the filters. Never conclude "no risky prompts were observed" from a truncated result.
vram_usage
[READ] Total VRAM used by loaded models; flag over-budget. Args: budget_bytes: Optional VRAM budget; models over it are flagged. target: Ollama target name from config; omit for the default.

Signals

Stars: 0
Forks: 0
Open issues: 0
Weekly downloads: 186
Last commit: Oct 15, 2026 (16 days ago)
Last release: Oct 15, 2026 (16 days ago)
Last package publish: Oct 15, 2026 (16 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name: io.github.AIops-tools/ai-guardian
Version: 0.13.0
Auth: No auth
Packages: pypi ai-guardian-aiops
License: MIT
Repository: github.com/AIops-tools/AI-Guardian
First seen: Oct 24, 2026
Last checked: Oct 25, 2026
Source: Official MCP Registry github-graphql

More from AIops-tools

Done for you

Rather not set it up yourself?

Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.

See how we build AI agents →Read the case studies

Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.

launches shipped: 50+; launches shipped
media placements: 500+; media placements
founders on every account: 2; founders on every account

Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block

Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.

Get AI Guardian running in your business

Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.

Need help deploying AI Guardian?

Call Get help

Cite this page

AI Guardian MCP server. Agent Mart. https://agentmart.dev/connectors/aiops-tools-ai-guardian (last updated 2026-10-25)