
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@agentguard47/mcp-server
Advanced tools
Read-only MCP server for coding-agent traces, decision events, alerts, costs, usage, and budget health
Read-only MCP (Model Context Protocol) server that connects coding agents to the AgentGuard Read API. Use it after the local SDK is already in place and you want Codex, Claude Code, Cursor, or another MCP client to inspect traces, decision events, alerts, usage, costs, and budget health.
The boundary is deliberate:
npx -y @agentguard47/mcp-server
| Tool | Description |
|---|---|
query_traces | Search recent traces, filter by service/time range |
get_trace | Get the full event tree for a specific trace ID |
get_trace_decisions | Extract normalized decision.* events from a specific trace ID |
get_alerts | Get guard alerts such as loops, budget exceeded, and errors |
get_usage | Check event quota usage and plan limits |
get_costs | Get cost breakdown by model for the current month |
check_budget | Quick pass/fail budget health check |
| Variable | Required | Description |
|---|---|---|
AGENTGUARD_API_KEY | Yes | Bearer token for the Read API (ag_...) |
AGENTGUARD_URL | No | API base URL (defaults to production) |
Add to your Claude Code MCP config:
{
"mcpServers": {
"agentguard": {
"command": "npx",
"args": ["-y", "@agentguard47/mcp-server"],
"env": {
"AGENTGUARD_API_KEY": "ag_your_key_here"
}
}
}
}
Any other MCP-compatible client that can launch an npm package over stdio can use the same command.
npm ci
npm run build
npm test
npm start
This repo now includes the files downstream registries expect when they build or inspect the MCP server from GitHub:
Dockerfile - container build for the stdio serversmithery.yaml - config schema for AGENTGUARD_API_KEY
and the optional base URLThat keeps the public repo aligned with the published npm package and makes the Glama / Smithery import path explicit instead of implicit.
The repo root also carries matching shim files for directories that only scan the default branch root:
Those root files delegate straight to mcp-server/ and should stay aligned
with the package-local versions here.
This repo now includes official MCP registry metadata in
server.json. The npm package is already public, and the Glama /
Smithery config now lives next to the source, so the remaining registry work is
metadata publication:
mcp-publisher login github
mcp-publisher publish
After that, verify the server is searchable from the MCP Registry API and then
submit it to downstream directories like Glama and awesome-mcp-servers.
src/index.ts - Server entry point, tool registration (stdio transport)src/client.ts - HTTP client wrapping /api/v1/ endpointssrc/decisions.ts - Decision-event extraction helpers for hosted tracessrc/schema.ts - JSON Schema to Zod shape builder used during tool registrationsrc/tools.ts - 7 MCP tool definitions and handlersFAQs
Read-only MCP server for coding-agent traces, decision events, alerts, costs, usage, and budget health
The npm package @agentguard47/mcp-server receives a total of 50 weekly downloads. As such, @agentguard47/mcp-server popularity was classified as not popular.
We found that @agentguard47/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.