Security & governance guardrails for MCP agents in Java — audit trail, agent-to-tool authorization, prompt-injection detection and rate limiting as a zero-config Spring Boot starter.
MCP Agent Guardrails helps you put security and governance controls around MCP tool calls in Java / Spring Boot applications with absolute minimum fuss. Every tool invocation runs through a chain of guardrails — audit, authorization, prompt-injection detection and rate limiting — before the tool executes.
When you expose MCP tools to LLM agents, the "client" is a model deciding on its own what to invoke and with which arguments. This project closes the four gaps that opens.
Work with zero configuration: add one dependency and all four guardrails are active with sensible in-memory defaults. Be opinionated, but get out of the way: every store, policy source and rule set is a port — expose your own bean and the default backs off. Fail closed: a guardrail that throws denies the call rather than passing it. The one deliberate exception is recording the decision trace — a broken audit store degrades observability, never protection, because a store that could block calls would be a single point of failure for the whole server. Never persist tool arguments (PII/secret risk) — audit trails carry metadata only.
Module Description ------ guardrails-core Shared model, Guardrail and ResultGuardrail SPIs, inbound and outbound chains, and the MCP tool-call interceptor guardrails-audit Audit trail of every invocation, every guardrail decision, both chains and every human approval guardrails-authz Declarative agent→tool authorization policy (first-match-wins rules) guardrails-injection-guard Rule-based prompt-injection detection over tool arguments guardrails-ratelimit Fixed-window rate
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/TikyParkinson--mcp-agent-guardrails-spring-boot-starter.html)
Security control plane for AI agents — identity and delegation, capability policy, data-flow taint and a live audit trail, enforced over MCP. Guards a real Claude Code end to end.
eltociear/mcp-auditScan MCP servers & AI-agent skills for malicious patterns (prompt injection in tool descriptions, credential exfil, download-and-execute). 17 patterns / 60 signatures, zero-dep. Measured over 196 publ
12122J/mcpvetMCP security scanner — vet a Model Context Protocol server before you add it to Claude Code, Cursor, or Windsurf. Grades it A–F, catching credential theft, tool-poisoning, and install-script payloads
Gowthaman90/mcp-bastionReliability + security proxy for the Model Context Protocol (MCP): self-healing connections, runtime tool-security (rug-pull/poisoning detection), and a compliance-mapped audit trail.
rdtan/architecture-discovery-mcpAuto-discover enterprise architecture artifacts (TOGAF AA series) from Java/Maven source code via MCP Server. Scan once, get Excel + PPTX in seconds.
Kota-Karthik/secure-actionsMCP server for secure AI agent authentication — lets Claude, Claude Code, and other LLM agents call APIs without exposing raw tokens or credentials to the model
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.