Mint Guard
Turn on built-in threat and data protection for every MCP gateway tool call. Mint Guard is a detection policy that MintMCP maintains and updates centrally, so you get prompt-injection and sensitive-data screening without writing your own rules or middleware.
Access Mint Guard at app.mintmcp.com/guardrails/mint-guard. Mint Guard is available on the Enterprise plan.
Every MCP tool call through the gateway is screened on both sides: the tool arguments the agent sends and the tool result the connector returns.
How Mint Guard fits with rules and middleware
Rules, middleware, and Mint Guard coexist on the same tool traffic, and any of them can block a call. They solve different problems:
| Use | When |
|---|---|
| Mint Guard | You want strong prompt-injection and sensitive-data screening out of the box, maintained by MintMCP, with one control and nothing to author. |
| Rules | You want to match specific tool names, argument patterns, or content with regex and pick an action. |
| Middleware | You want your own logic: call an external classifier, enforce a resource allowlist, or connect the DLP service your security team already runs. |
What Mint Guard detects
| Category | What it detects | Current action |
|---|---|---|
| Prompt injection | Instructions hidden in tool arguments or tool results that try to hijack the agent | Blocks at high confidence |
| Credentials & secrets | API keys, tokens, and passwords moving through tool calls | Logs |
| PII | Personal data such as contact details and identifiers | Logs |
| Harmful content | Unsafe or abusive content in tool arguments and results | Logs |
Prompt injection blocks only at high confidence, so lower-confidence matches are recorded without stopping the call.
Choose how it applies
| Mode | Effect on tool calls |
|---|---|
| Off | Tool calls are not screened. |
| Monitoring | Every call is screened and detections are recorded, without changing any call. Detections the policy would block are recorded as would-block, so you can see the impact of enforcement before turning it on. |
| Enforcing | Calls with a detection the policy blocks are stopped and return an error to the calling agent. Every other detection is recorded only. |
Start in Monitoring to see what Mint Guard finds on your real traffic, review the flagged calls in MCP Activity, then move to Enforcing once you are confident in the impact.
What a blocked call looks like
In Enforcing mode, a blocked call never reaches the upstream connector on the request side, and on the response side the upstream result is withheld from the agent. The calling agent receives a terse error naming the category that triggered the block, for example Blocked by Mint Guard: prompt injection detected. Blocked calls appear in MCP Activity with the blocking category.
Review detections
Every scanned call records its Mint Guard result in MCP Activity. To see only flagged calls, use the Mint Guard hit filter under More filters. The Mint Guard page also summarizes the last 7 days: tool calls scanned, calls flagged to block, and findings by category.
What gets recorded
Mint Guard records the category, a confidence band, and for sensitive-data categories the kind of data matched (for example EMAIL_ADDRESS or PASSWORD). The matched value is never stored. These findings are retained even when full tool-call logging is turned off.
Permissions
Changing the Mint Guard mode requires guardrails manage access (org:guardrails:manage). Members without it see the current state and the detection policy but cannot change the mode.
Availability
To enable Mint Guard for your organization, contact enterprise@mintmcp.com.