// SCAN REPORT

Project Guardian MCP

38 tools. 21 can modify or destroy data without limits.

5 destructive tools with no built-in limits. Policy required.

Last updated: 14 Oct 2026

21 can modify or destroy data

17 read-only

38 tools total

Community server · catalogue entry checked 14/10/2026

How to control Project Guardian MCP ↓

TOOL MAP

What Project Guardian MCP exposes to your agents

Read (17) Write / Execute (16) Destructive / Financial (5)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Project Guardian MCP tools

Destructive · High cache_delete This tool permanently removes cached data from Redis. Destructive · High delete_data Deletion of database records is irreversible and constitutes destructive action. Destructive · High delete_entity This tool permanently removes entities and associated relations from the knowledge graph without explicit undo capability mentioned. Destructive · High delete_observation This tool permanently deletes observations from the knowledge graph database.

21 of Project Guardian MCP's 38 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Project Guardian MCP

PolicyLayer is an MCP gateway — it sits between your AI agents and Project Guardian MCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "cache_delete": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_observation": {
    "limits": [
      {
        "counter": "add_observation_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "analyze_git_changes": {
    "limits": [
      {
        "counter": "analyze_git_changes_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Project Guardian MCP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON PROJECT GUARDIAN →

Instant setup, no code required.

FULL CATALOGUE

All 38 Project Guardian MCP tools

DESTRUCTIVE 5 tools

Destructive cache_delete Delete a value from the optional Redis companion cache Destructive delete_data Delete records from memory.db table Destructive delete_entity Delete entity/entities and their relations from project memory Destructive delete_observation Remove specific observation(s) from entity/entities Destructive delete_relation Delete relation(s) between project entities

EXECUTE 6 tools

Execute close_ui Stop the Project Guardian Web UI server if running. Use after start_ui or to free port 3000. Execute execute_sql Execute raw SQL query on the project or central memory database (database: Execute initialize_memory Initialize the project memory system and database schema Execute scan_container_image Scan a container image for HIGH and CRITICAL vulnerabilities using Trivy Execute start_ui Start the Project Guardian Web UI server on demand. Automatically searches for a free port and returns the loc Execute stop_ui Alias for close_ui — stop the Web UI server.

WRITE 10 tools

Write add_observation Add observation(s) to project entity/entities Write cache_set Set a value in the optional Redis companion cache Write create_entity Create entity/entities in the project knowledge graph Write create_relation Create relation(s) between project entities Write import_data Import data from file into memory.db table Write insert_data Insert records into a project or central memory table (database: Write set_project_root Switch the active project memory database to the given absolute project path. Use at session start when the se Write setup_pre_commit Create a .pre-commit-config.yaml in the active project root and install the Git hooks, on demand. Requires pre Write sync_harness_sessions Read-only sync of harness sessions (titles, summaries, timestamps; secrets redacted) into the project knowledg Write update_data Update records in memory.db table

READ 17 tools

Read analyze_git_changes Analyze bounded Git changes and untracked files in the current workspace Read cache_get Get a value from the optional Redis companion cache Read cache_scan Scan namespaced keys in the optional Redis companion cache Read export_data Export memory.db table data to file Read get_file_context Get historical memory, recent modifications, linked tasks, and open bugs for a specific file path before editi Read get_project_guidance Invoke a project guidance framework to receive specialized instructions and checklists for specific workflows Read get_session_context Summarize active tasks, open bugs, recent changes, and blockers from project memory Read get_timeline Get a chronological feed of recent observations and project activity Read inspect_untrusted_text Normalize untrusted text and detect common prompt-injection indicators Read list_harness_stores List local agent-harness session stores (opencode, kilocode, zed, delta, antigravity, cursor, vscode, codex): Read open_node Get detailed information about project entity/entities Read query_data Query data from project or central memory tables (database: Read read_graph Read the entire project knowledge graph Read read_graph_stream Stream the knowledge graph with cursor pagination (500/page, updated_at DESC). Returns entities, relations, ne Read scan_project_secrets Scan a workspace-relative path for likely hardcoded credentials without exposing values Read search_nodes Search project entities and relations with hybrid RAG and progressive disclosure Read sync_central_memory Sync the active project knowledge graph into the central memory database (~/memory/memory.db by default) so al

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Project Guardian MCP

Can an AI agent delete data through the Project Guardian MCP server? +

Yes. The Project Guardian MCP server exposes 5 destructive tools including cache_delete, delete_data, delete_entity. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Project Guardian MCP? +

The Project Guardian MCP server has 10 write tools including add_observation, cache_set, create_entity. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Project Guardian MCP.

How many tools does the Project Guardian MCP server expose? +

38 tools across 4 categories: Destructive, Execute, Read, Write. 17 are read-only. 21 can modify, create, or delete data.

How do I enforce a policy on Project Guardian MCP? +

Register the Project Guardian MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Project Guardian MCP tool call.

Deterministic rules across all 38 Project Guardian MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON PROJECT GUARDIAN →

Instant setup, no code required.

38 Project Guardian MCP tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Project Guardian's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →