Quickstart (MCP client)

If you already use an MCP client — Claude Desktop, Claude Code, Cursor, or a custom client — you can govern every tool call it makes by pointing it at a Guardyx endpoint. Setup is a config change, not a migration: your agent, tools, and prompts stay exactly as they are.

Three steps: grab your connection values, add the Guardyx server to your client, and confirm calls are being governed.

1. Get your connection values

Both values come from the portal’s Agent created modal, shown when you create an agent:

Host — your per-tenant Guardyx URL, e.g. https://your-guardyx-host.
API key — a gx_live_… key. Treat it like a password; don’t commit it to source control.

Your MCP endpoint is the host with /v1/mcp appended.

2. Connect your MCP client

Guardyx is reached over the standard mcp-remote proxy, so one server entry works in any MCP client. Add this guardyx server under mcpServers:

{
  "mcpServers": {
    "guardyx": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote",
        "https://your-guardyx-host/v1/mcp",
        "--header", "X-API-Key:gx_live_YOUR_KEY"
      ]
    }
  }
}

Where that config lives depends on the client.

Claude Desktop

Open Settings → Developer → Edit Config, or edit the file directly:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

Add the guardyx entry under mcpServers, then fully quit and reopen Claude Desktop — it loads MCP servers only at startup.

Claude Code

claude mcp add -s project guardyx -- \
  npx -y mcp-remote https://your-guardyx-host/v1/mcp --header "X-API-Key:gx_live_YOUR_KEY"

The -s project scope writes the same guardyx entry to a .mcp.json you can commit for the team. Run claude mcp list to confirm it connects.

Cursor

Create or edit .cursor/mcp.json (project) or ~/.cursor/mcp.json (global), add the guardyx entry under mcpServers, and reload the window. Cursor shows the server under Settings → MCP.

Other MCP clients

Any MCP-capable host — ChatGPT Desktop, a custom client — takes the same guardyx server entry wherever it reads its MCP server configuration. If your client can’t spawn a local command, run mcp-remote yourself and point the client at it.

3. Verify it’s governing calls

Restart the client and have your agent make a tool call. In the Guardyx portal you should see:

the call in the run trace, with its inputs, the policy decision, and the outcome;
an approval prompt for any action your policies hold for review — the client blocks on that call until you approve or deny it.

If a call runs but never shows up in the trace, the client isn’t routed through Guardyx. Recheck the host, the /v1/mcp path, and the X-API-Key header, then restart the client.

What happens next

Once connected, Guardyx routes every tool call the client makes. Every AI action passes through Guardyx. It evaluates policy, holds sensitive actions for human approval, and records the full request, decision, and outcome in a tamper-evident run trace.