On your machine

The same studio and the same policy run on your machine. The page opens at 127.0.0.1 with a token of its own, and every server is reachable: local commands, and servers a browser may not call.

Install

Node 18+: download okay-guard.zip, unzip it, and run node okay-guard.js --open.
Java 17+: download okay-guard.jar and run java -jar okay-guard.jar --open.

Made something on the site first? There, Tools → Export a copy; here, Tools → Import a copy. The agents, their servers and their policies come along.

Connect your agent

Your agent connects to the address the studio shows, http://127.0.0.1:…/m/…/mcp. Or put okay-guard where a server's command was, in any MCP client over stdio; the policy is a file:

{ "mcpServers": { "stripe": { "command": "node",
    "args": ["/path/to/okay-guard.js", "--rules", "/path/to/stripe.policy", "--open",
             "--", "npx", "-y", "@stripe/mcp", "--api-key=${STRIPE_KEY}"] } } }

On Java, use "command": "java", "args": ["-jar", "/path/to/okay-guard.jar", …].

Servers

In Tools:

an MCP server by its URL;
an MCP server by its command, run by the machine; ${NAME} in it is the variable NAME of the environment, so a key stays out of the files;
a REST API by its OpenAPI, with a header for its key if it needs one.

Commands

command	what it does
`okay-guard --open`	the studio
`okay-guard --lan`	the page in the local network too (a phone on the same Wi-Fi)
`okay-guard check x.policy`	the policy's tests (`x.tests` beside it); exit 1 if one fails
`okay-guard journal …`	the journal: read, exported, checked, replayed
`okay-guard --rules x.policy -- <server>`	an agent on stdio, its calls decided by the policy
`okay-guard --keep 90`	the journal's days older than 90 removed

A policy's webhooks with env "VAR" take the address from the environment here.