> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beyondguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# MCP Guard: Validate Tool Calls and Secure MCP Servers
> MCP Guard inspects every tool call, MCP server interaction, and API integration to detect tool poisoning, parameter injection, and schema violations.
As AI agents increasingly rely on external tools and services to accomplish real-world tasks, those integrations become a critical attack surface. An agent that can search the web, query a database, send messages, or execute code is only as secure as the tools it is allowed to call. MCP Guard sits between your agent and every external tool or MCP server it interacts with, validating each call against registered schemas, enforcing your tool allowlist, and detecting the anomalous parameter patterns that signal an active attack. Because MCP Guard is structurally independent from your agent and your tools, it cannot be bypassed by manipulating either side of the connection.
## What MCP Guard Detects
MCP Guard targets the class of threats that specifically exploit the agent-to-tool interface.
* **Tool Poisoning:** Malicious or compromised tool definitions that have been tampered with to manipulate agent behavior — for example, a tool whose description has been altered to include hidden instructions, or a tool endpoint that has been silently redirected to an attacker-controlled server.
* **Parameter Injection:** Unexpected or malicious parameter values passed to a tool call — for example, a file path argument that contains a directory traversal sequence, or a query parameter that embeds SQL or shell commands designed to exploit the receiving service.
* **Schema Violation:** Tool calls or tool responses that deviate from their expected schemas. Schema violations may indicate a compromised tool server sending unexpected payloads, a model hallucinating non-existent parameters, or an attacker attempting to smuggle data through an out-of-spec field.
## What Is MCP?
The Model Context Protocol (MCP) is an open standard for connecting AI agents to external tools, APIs, and data sources in a structured, interoperable way. MCP defines how an agent discovers available tools, how it formats tool call requests, and how tool servers return results. It is rapidly becoming the default integration layer for agentic AI systems.
Because MCP standardizes the interface between agents and tools, it also standardizes the attack surface. A single vulnerability in how an agent trusts or processes MCP server responses can be exploited across every tool that agent connects to. MCP Guard secures this interface by validating both sides of every MCP interaction against your registered schemas and policies, ensuring that neither the agent nor the tool can be manipulated through the integration layer.
## How MCP Guard Works
MCP Guard proxies every tool call and tool response through a validation pipeline before either side acts on the content.
When your agent issues a tool call, MCP Guard intercepts the request before it leaves your environment. The target tool name, parameter names, and parameter values are extracted for inspection.
MCP Guard checks the requested tool against your registered tool allowlist. Calls to unregistered tools are immediately flagged or blocked, depending on your operating mode, regardless of their content.
The full tool call — including every parameter name and value — is validated against the registered schema for that tool. Type mismatches, unexpected fields, and out-of-range values are flagged as schema violations.
Even parameter values that are schema-valid are evaluated for anomalous patterns: path traversal sequences, injection payloads, encoded commands, and statistically unusual values for the given parameter context.
When the tool server returns a response, MCP Guard validates the response payload against the registered schema before forwarding it to your agent. Unexpected fields or out-of-spec response structures are flagged as potential tool poisoning.
Each inspected call and response receives a policy decision: allow, flag, or block. All events are recorded in the audit log with the full call payload, matched threat patterns, and decision outcome.
## Configuring MCP Guard
Enable and configure MCP Guard from the BeyondGuard Control Plane.
Navigate to the [Control Plane](https://app.beyondguard.io) and select the project that manages your agent's tool integrations.
Inside your project, select the **Guards** tab from the left navigation panel.
Locate **MCP Guard** in the guard list and toggle it to **Enabled**.
Click **Manage Tool Registry** to open the schema editor. For each tool your agent is permitted to call, upload or paste the tool's JSON Schema definition. MCP Guard uses these schemas for both allowlist enforcement and parameter validation.
For tools with parameters that carry structured values — file paths, URLs, query strings — open the **Parameter Rules** panel and configure additional validation rules beyond schema type checking, such as path prefix allowlists or URL domain restrictions.
Under **Response Settings**, enable response schema validation for tools whose outputs are consumed by your agent's reasoning process. Set the action to take on schema-violating responses: flag or block.
Select **Observation Mode** to log all detections without blocking traffic, or **Enforcement Mode** to actively block non-compliant calls and responses.
Click **Save Configuration**. MCP Guard begins inspecting all tool calls on this project immediately.
Only register tools from trusted, verified sources. MCP Guard flags all calls to unregistered tools — but it can only validate the content of calls to tools whose schemas you have registered. If you add a tool to your agent without registering it in MCP Guard, calls to that tool will be flagged as unregistered but will not benefit from schema or parameter validation. Treat your tool registry as a security boundary and audit it whenever you add or update agent integrations.
## Operating Modes
MCP Guard supports two operating modes. You can switch between them at any time from the Control Plane without downtime.
| | **Observation Mode** | **Enforcement Mode** |
| ----------------------- | ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| **What it does** | Inspects every tool call and response, logs violations, but never blocks traffic | Inspects every tool call and response, and actively blocks non-compliant calls and schema-violating responses |
| **Effect on agents** | No impact — all tool calls proceed regardless of detections | Blocked calls receive an error response; the agent cannot proceed with that tool invocation |
| **Best used for** | Auditing tool call patterns, validating registered schemas, evaluating MCP Guard before go-live | Production enforcement once your tool registry is complete and schemas are validated |
| **Audit logging** | Full — all violations and anomalies recorded | Full — all decisions (allow, flag, block) recorded with full call payloads |
| **False positive risk** | Zero traffic impact even if schemas are misconfigured | Incomplete or overly strict schemas may block legitimate tool calls |
Before enabling Enforcement Mode, run MCP Guard in Observation Mode for a representative sample of agent activity. Use the logged detections to identify any tool calls your schemas do not yet cover, and update your tool registry accordingly. This prevents Enforcement Mode from blocking legitimate traffic due to missing or incomplete schema definitions.