Guides

What people set this up to do. Each one says what it covers, what the configuration looks like, and where it stops, which is the part most of this kind of writing leaves out.

They assume the package is installed and describe the current release. If you want the architecture rather than the setup, that lives in the design document.

npm install -g agent-chaperone

The guides #

• Screen MCP tool calls before they run

  One change to a client configuration puts a server behind the screen. What crosses the proxy, what the pre-call and post-result screens ask, and where a proxy stops seeing anything.

• Screen tool results for prompt injection before the agent reads them

  A fetched page, a file and an API response are all text somebody else wrote, and the agent reads them as input. What the screen catches, and the measured count of what it does not.

• Screen Claude Code's built-in tools

  A proxy sees MCP traffic and nothing else. Three hooks put the same screens in front of the shell, the file edits and the fetches a client runs itself.

• Catch secret-leaking tool calls before they run

  Reading a file and posting to a URL are both ordinary. The pair is the problem, and a list of allowed tools cannot express it.

• Run agent-chaperone alongside ECC

  ECC checks your setup and makes the agent look before it edits. This checks what each call does and what each result says, and runs next to ECC's hooks without changing them.

• Screen MCP tool calls in Cursor

  Cursor keeps servers in JSON that wrap can edit. The change, how the key reaches the proxy, and what Cursor runs outside MCP.

• Screen MCP tool calls in Codex

  Codex keeps servers in TOML and starts them with a cleared environment, so the key has to be forwarded by name. The change, by hand, and the timeouts to set.

• Screen MCP tool calls in VS Code

  VS Code lists servers under servers rather than mcpServers and allows comments in the file. The change, the key, and where wrap has to give way to a hand edit.

• Screen MCP tool calls in Gemini CLI

  Gemini CLI strips variables named like credentials from a server's environment, the API key included. The change, and the env line that gets the key through.

• Screen tool calls in Hermes Agent

  Hermes keeps servers in YAML and hands them a filtered environment. The change, the env line for the key, and the plugin that screens Hermes's own terminal, edits and fetches.

Everything else #

• Measured results

  One dated run against public prompt-injection benchmarks and hand-labeled tool calls, with every threshold, what was caught, what was missed and what was flagged in error.

• Docs

  The design, with the exact wording of every screening question, the policy file and the audit log format, plus the hooks reference and the benchmark method.

• Decision records

  Why the main choices went the way they did, including the ones that were reversed.