okay-guard
Open the studioGetting started
okay-guard stands between an AI agent and the services it works with. The services are MCP servers and REST APIs. You see every call the agent makes. Your policy decides what passes, what is blocked and what waits for a person, and you decide where the call stands. Every call is recorded with its decision and why.
The agent is yours: Claude Code, Claude Desktop, Claude.ai, Cursor, any MCP client. The studio runs no model of its own and asks for no key.
The studio's places
| place | what it is |
|---|---|
| Tools | how your agent connects (its address), and the servers and APIs it reaches |
| Rules | the policy: its rules as cards, what happens when no rule applies, its whole text |
| Tests | the policy's tests, made of your agent's calls; the journal decided again |
| Run | your agent's calls as they happen, each with its decision; a call that waits for you |
| Log | every message, raw; the audit journal, downloaded or checked |
| Docs | these pages |
1. Connect your agent
Open Tools. The studio shows an MCP address for the chosen agent. Give it to your agent:
claude mcp add --transport http okay-guard <the address>
In other agents:
| agent | how |
|---|---|
| Codex (CLI, IDE) | codex mcp add okay-guard --url <the address>, or in ~/.codex/config.toml: a table [mcp_servers.okay-guard] with url = "<the address>". codex mcp list shows it; /mcp in Codex shows its tools |
| Claude.ai, Claude Desktop | Settings → Connectors → Add custom connector: the address |
| ChatGPT | Settings → Apps & Connectors → Advanced settings: turn on Developer mode; then Create a connector with the address, no authentication, and turn it on in a chat |
| Cursor, VS Code, others | an MCP server over HTTP (Streamable HTTP): the address |
ChatGPT and Claude.ai work in the cloud: they reach the address of the studio on the site (https://okay-guard.okay-effects.workers.dev/m/…/mcp), not one on your machine (http://127.0.0.1:…). Codex, Claude Code and Cursor run on your computer and reach either.
Keep the studio's page open while the agent works: its calls are decided in the page. To take an agent away again: claude mcp remove okay-guard, in Codex its remove (codex mcp --help) or enabled = false in its table, or remove the connector in the app's settings.
The first agent works with a simulated payments server, so nothing real can happen. Try the prompt the studio suggests (Copy the prompt).
2. Watch and decide
Open Run. Each call shows its tool, its arguments and the decision. A call the policy asks about waits on its card: Approve, Refuse, or Change its arguments first. If no one answers in time, the agent is told it is not done.
3. Write the policy
Use Make a rule on a call's card, or open Rules:
- each rule is a card; Remove takes it out;
- When no rule applies says what happens then: allow, ask a person, or deny;
- A new rule writes a rule from a form;
- Its text is the whole policy, in the policy language.
4. Add the tools you need
In Tools, add an MCP server by its URL, or a REST API by its OpenAPI: its operations become your agent's tools, and each call is decided by the policy before it is made. Servers to try has DeepWiki and Swagger's pet store; no key is needed.
5. Test it
In Tests, Make tests of the calls seen turns your agent's calls into tests: each call and the decision it got. They run at every change of the policy. Replay the journal decides every recorded call again by the policy as it is now, and shows what would change. See tests.
6. Take it to your machine
In Tools, Export a copy saves the agents, their servers and their policies in one file. Run okay-guard on your machine and Import a copy there: the same policy decides, and every server is reachable. See on your machine.