Quickstart (MCP client)

If you already use an MCP client — Claude Desktop, Claude Code, Cursor, or a custom client — you can govern every tool call it makes by pointing it at a Guardyx endpoint. Setup is a config change, not a migration: your agent, tools, and prompts stay exactly as they are.

Three steps: grab your connection values, add the Guardyx server to your client, and confirm calls are being governed.

Both values come from the portal’s Agent created modal, shown when you create an agent:

• Server URL — https://app.guardyx.ai/v1/mcp.
• API key — a gx_live_… key. Treat it like a password; don’t commit it to source control.

Every snippet below already uses that URL; you only add your key.

Guardyx is reached over the standard mcp-remote proxy, so one server entry works in any MCP client. Add this guardyx server under mcpServers:

{
  "mcpServers": {
    "guardyx": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote",
        "https://app.guardyx.ai/v1/mcp",
        "--header", "X-API-Key:gx_live_YOUR_KEY"
      ]
    }
  }
}

Where that config lives depends on the client.

Open Settings → Developer → Edit Config, or edit the file directly:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Add the guardyx entry under mcpServers, then fully quit and reopen Claude Desktop — it loads MCP servers only at startup.

Keep the key in an environment variable (put the export in your shell profile so it outlasts this session), then register the server from your project root:

export GUARDYX_API_KEY=gx_live_YOUR_KEY
claude mcp add -s project guardyx -- \
  npx -y mcp-remote https://app.guardyx.ai/v1/mcp --header 'X-API-Key:${GUARDYX_API_KEY}'

The single quotes keep ${GUARDYX_API_KEY} unexpanded, so the .mcp.json that -s project writes names the variable, not your key, and you can commit it for the team. Each teammate exports their own key. Run claude mcp list to confirm it connects. The Claude guide covers the other scopes.

Create or edit .cursor/mcp.json (project) or ~/.cursor/mcp.json (global), add the guardyx entry under mcpServers, and reload the window. Cursor shows the server under Settings → MCP.

These connect over HTTPS without the mcp-remote entry, and each one authenticates differently: ChatGPT sends the key as Authorization: Bearer, and Claude.ai, Meta Muse and Grok Bot sign in over OAuth. Follow the client’s own guide: Claude, ChatGPT, Meta Muse, or Grok Bot.

Any other MCP-capable host takes the same guardyx server entry wherever it reads its MCP server configuration. If your client can’t spawn a local command, run mcp-remote yourself and point the client at it.

Restart the client and have your agent make a tool call. In the Guardyx portal you should see:

• the call in the run trace, with its inputs, the policy decision, and the outcome;
• an approval prompt for any action your policies hold for review. Guardyx holds that call until you approve or deny it; if you take longer than about 25 seconds, the client gets a retry message, and the retried call picks up your decision.

If a call runs but never shows up in the trace, the client isn’t routed through Guardyx. Recheck the URL, the /v1/mcp path, and the X-API-Key header, then restart the client.

Once connected, Guardyx routes every tool call the client makes. Every AI action passes through Guardyx. It evaluates policy, holds sensitive actions for human approval, and records the full request, decision, and outcome in a tamper-evident run trace.