agent47BLOCK
Python runtime checks for AI agents: budgets, loops, retries, and local traces. Zero runtime dependencies. MIT.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Stop runaway agents with runtime checks in Python.
[](https://pypi.org/project/agentguard47/) [](https://pypi.org/project/agentguard47/) [](https://github.com/bmdhodl/agent47/actions/workflows/ci.yml) [](LICENSE)
AgentGuard checks budgets, repeated tool calls, retries, and elapsed time in instrumented Python code. Guards raise exceptions so your application can stop the next operation. The base SDK has no runtime dependencies and needs no account.
Names: this repository is agent47, the PyPI package is agentguard47, and the Python import is agentguard. AgentGuard 2.0.0 requires Python 3.11 or newer. On Python 3.9 or 3.10, pin agentguard47==1.4.0. See the Python migration guide before upgrading.
Getting started
Install in a virtual environment, then run the offline checks:
python -m pip install agentguard47 agentguard doctor agentguard demo
doctor checks the installation and local trace writing. demo exercises budget, loop, and retry stops without provider keys or network access. Follow the trace path printed by the command to inspect its output. agentguard demo --feedback prints a local redacted report; nothing is sent.
For a fresh PowerShell install and a runnable raw starter, follow the published-release walkthrough.
Share a stop receipt (new in 2.0.0)
agentguard receipt agentguard_demo_traces.jsonl prints a receipt of each stop with the trace's SHA-256 drawn as a barcode. Add --format markdown to paste it into a PR or issue. The hash identifies the trace file; it is not a signature.
Guard a Claude Code session (new in 2.0.0)
e4dfe2b2f5ddOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env AGENTGUARD_API_KEY=${AGENTGUARD_API_KEY} -- npx -y @agentguard47/[email protected]Exposed tools (12)
10 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
check_budget | read | Read-only hosted event-quota health check. Combines dashboard event quota and |
check_remaining | read | Return current usage and limits for a scope. |
get_alerts | read | Read-only recent guard alerts (loop detection, budget exceeded) and errors |
get_costs | read | Read-only hosted cost breakdown for the current month from the AgentGuard Read API. |
get_trace | read | Read-only full event tree for one retained trace. |
get_trace_decisions | read | Read-only normalized decision.* events from one retained trace. |
get_usage | read | Read-only hosted event quota usage and plan limits from the AgentGuard Read API. |
kill_switch | destructive | Block or unblock calls matching a scope. |
list_budgets | read | List configured budgets and current local usage. |
query_traces | read | Read-only search for retained AgentGuard trace summaries from the AgentGuard Read API. |
record_call | read | Record one MCP tool call if matching budgets still allow it. |
set_budget | write | Set a local token or dollar budget for a scope. |
Trust audit
BLOCKgrade F · trust 45/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
db_path C:\Users\patri\AppData\Local\Temp\tmpi09qb3ct\state.db
Rebased-head validation for budget-aware escalation:
b088773 Record activation PR handoff
52`tPinnedDependenciesID`t.github/workflows/publish.yml`t29`tscore is 5: pipCommand not pinned by hash
agent47-approved735-example.py.gz
.claude/skills/next-ticket
.codex/skills/next-ticket
.cursor/skills/next-ticket
httpx = importlib.import_module(base.__module__.split(".")[0]){"kind": "span", "phase": "start", "name": "invalid", "ts": 10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000{"kind": "span", "phase": "end", "name": "invalid", "duration_ms": 1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000[{"attestation":{"bundle":{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIG8TCCBnegAwIBAgIUObrZhtSkVaCIYNJYUSPSi2LDia0wCgYIKoZIzj0EAw[{"attestation":{"bundle":{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIG8jCCBnegAwIBAgIUS2NTF0uv7jy7brVlQ6c9tmyEb5IwCgYIKoZIzj0EAwkill_switch
git-diff.txt
preflight.txt
pypi-sync.txt
release-guard.txt
.gitleaksignore
.agentguard.json
.agentguard.json
.github/skills/next-ticket
return importlib.import_module(module)
self._http = importlib.import_module(client_base.__module__.split(".")[0])exec(code, ns) # noqa: S102
Gates applied: no_behavioural_pass.
e4dfe2b2f5ddfull audit observations/trust-audit/mcp-server/bmdhodl__agent47.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | e4dfe2b2f5dd | BLOCK | F | 45 | first audit |
Questions
What is the agent47 MCP server?
Python runtime checks for AI agents: budgets, loops, retries, and local traces. Zero runtime dependencies. MIT.
What tools does agent47 expose?
12 in total: 10 read-only, 1 that write, and 1 that can delete or overwrite (kill_switch). Every one is listed on this page with its risk.
Is agent47 safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (45/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does agent47 need?
It reads AGENTGUARD_API_KEY, AGENTGUARD_KEY, AGENTGUARD_RELEASE_API_KEY, AGENTGUARD_SYNC_TOKEN, AG_API_KEY, ANTHROPIC_API_KEY, GH_TOKEN, OPENAI_ADMIN_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does agent47 run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @agentguard47/mcp-server at 0.2.2.
How current is this page?
The grade is for one exact copy of the source (e4dfe2b2f5dd), read on 2026-10-11. The repository is watched and re-audited when it changes.