Sigrid Guardrails MCP

Agent guardrails use Sigrid’s code analysis to prevent issues from being introduced. They give your AI coding assistant access to that analysis during generation, so the agent checks its own output as it works. Security vulnerabilities and quality issues get caught before they land in a commit.

This is the counterpart to the auto-fix agent, which fixes and improves issues that already exist.

For installation instructions, see the MCP overview page. For a walkthrough of using this in day-to-day feature work, see the guide on building with an AI coding agent and Sigrid Guardrails.

Supported technologies

Currently supported:

• Java
• Python
• C/C++
• C#
• JavaScript
• TypeScript
• Kotlin
• Progress ABL
• PHP

Visit the Technology Support page for more details on supported technologies.

Set up the quality gate

The quality of AI-generated code varies a lot with the instructions the agent was given. Guardrails tells the agent which quality standards its code fails to meet, reading the working tree, so the system does not have to be published to Sigrid first.

Connecting the MCP server is only half of it, since the agent will not call the tool unless something tells it to. The instruction belongs in your agent’s instruction file, where it applies to every session without you asking. The prompt below pairs brief code principles with a mandatory quality gate before any task is reported complete:

## Code Principles

Write maintainable, self-documenting code: single responsibility, small focused
functions, clear naming, avoid duplication, simple control flow.

## MANDATORY: Quality Gate

Before reporting ANY task as complete:

1. Run the Sigrid guardrails:quality_check MCP tool on all files you changed
2. Maintainability findings: fix every finding in files you touched, new or
   pre-existing, judged against the principles above. Leave one only if the code
   already honors the principles, or the fix cascades outside task scope
   (don't get stuck). Say which, and why.
3. Security findings: fix if contained, otherwise flag to user

Only skip if the tool is unavailable and say so if you do.

The quality gate applies the Boy Scout Rule: leave each file you touch cleaner than you found it.

Two adjustments are worth making from the start. If your codebase follows specific design patterns, such as hexagonal architecture or Redux, add them under Code Principles, and write a principle for every recurring mistake you find yourself correcting. You can also loosen the timing to commits only, and you can always invoke the check by hand: “Run Sigrid on these files: …”.

For which wording in that prompt carries it, and a session where the agent refactors in response to a finding, see building with an AI coding agent and Sigrid Guardrails.

Where to place these instructions

Most AI coding agents respect instruction files in your repository. Refer to your agent’s documentation for specifics.

For tools that support both global and project-level rules, prefer project-level to keep instructions versioned with your code.

What Guardrails does not see

Guardrails reads one file at a time, so anything that only shows up across a whole system stays invisible to it: architecture drift, vulnerable dependencies, duplication spread across files. Sigrid CI covers vulnerable dependencies and duplication; running it in a pre-commit hook or in your pipeline also gives you a check the agent cannot decide it has already satisfied. Architecture drift has its own diff-scoped check, grounded in Sigrid’s dependency graph rather than a single file; see preventing architecture drift.