VPS Guardian · MCP Access

MCP Access

Not loaded

Connect to Guardian 0.30.0+ to load the server-side access policy.

Allow agent access

Turn off to pause new MCP calls. Running operations are not cancelled.

Maximum safety mode

A cap can restrict, not elevate, an agent's launch mode. Controlled tokens are not independent human approval.

Allowed tools

—

Allow all installed and future tools

Uncheck to use an explicit allowlist. get_safety_status stays available for recovery.

The tool catalog will appear after connecting.

Inherit project roots from MCP launch settings Project roots one absolute VPS directory per line

Custom roots replace VPS_GUARDIAN_PROJECT_ROOTS. An empty custom list blocks project workspaces. Configuration-file tools have their own fixed directories.

No policy loaded.

Policy is saved on the VPS and shared by upgraded Guardian processes running as this SSH user. Older agents must upgrade and reconnect once. This is an MCP boundary, not isolation from root SSH or server-code access.

Projects

Explore project metadata inside the configured roots. No source is read and no project commands are executed.

Connect to Guardian 0.31.0+ on the VPS to browse projects.

Discovered projects Project directory absolute VPS path

Selecting or inspecting a project does not change agent permissions. Use as root prepares an Access draft; review and Apply permissions there. Explicit managed roots are shared; inherited roots may differ between agent launch environments.

No project selected.

Resource limits

Not loaded

Shared, server-enforced budgets for subsequent operations. Host protection always applies, including with Standard and Custom profiles.

Connect to Guardian 0.31.0+ to load limits.

Capsule isolation stays fixed: 128 MiB RAM, 0.5 CPU, 30 seconds, 4 KiB output. These cooperative limits do not impose a global CPU/RAM quota, cancel in-flight operations or constrain ordinary SSH. Upgrade every agent's server executable to 0.31.0+ and reconnect once.

Operations

Shared with agents on this server, under this SSH user. Staged changes survive reconnects; this view never executes, approves or retries them.

Search loaded operations

Show

Connect to Guardian 0.32.0+ to load shared operations.

No history loaded.

Select an operation to inspect its metadata.

Drafts expire after 24 hours. Up to 200 finished records are retained for 30 days; source payloads are removed on completion or expiry. An interrupted write can be uncertain: inspect live files, never blindly repeat it. Confirmation tokens remain session-local; preview again after reconnecting. Jobs have their own TTL and 100-record cap.

Control what agents can do.