Last updated: July 18, 2026
- We open-sourced
seosiri-api-guard-mcp-serverv1.0.0, a stateless MCP server that intercepts and sanitizes LLM-generated API payloads before they reach the network or physical hardware. - It runs as a single tool,
sanitize_and_validate_payload, with five configurable compliance profiles: OWASP core, PCI-DSS, HIPAA/FHIR, SEO/GDPR, and a Biorobotics Safety Interlock. - Live-tested: a payload containing both a raw credit card number and an unsafe G-code command was caught, redacted, and automatically remediated in a single call.
- It's designed to pair directly with the SEOSiri Bio-Robotics Core Engine, sitting in front of it as a safety gate for AI-generated hardware commands.
What Does the SEOSiri API Guard Actually Do?
It sits between an AI agent (Claude Code, Cursor, or any MCP client) and the outside world, inspecting every proposed API payload or hardware command before it's sent. Depending on which compliance profiles are active, it strips exposed credentials, redacts payment card numbers, scrubs health-record identifiers, checks SEO metadata against length limits, and clamps physical robotics commands to safe mechanical boundaries — all locally, in one call, before anything leaves the machine.
AI agents are increasingly trusted to generate API requests and, in SEOSiri's own bio-robotics work, physical hardware commands. That trust has a failure mode: an agent can leak a hardcoded credential into a request, generate a payload that fails an injection check, or propose a G-code command that exceeds a robot's physical deck limits. seosiri-api-guard-mcp-server is a local, open-source interception layer built on the Model Context Protocol (MCP) that catches these before they cause damage — financial, medical, reputational, or physical.
Why a Single Gatekeeper Instead of Separate Tools
The guard exposes exactly one MCP tool, sanitize_and_validate_payload, rather than a separate tool per compliance domain. A proposed payload and a comma-separated list of active profiles (e.g. pci,biorobotics) are passed in together, and the server applies every requested profile's checks in a single pass. That design choice matters for AI agents specifically: an agent only needs to learn one tool call, not five, and can combine profiles freely — a fintech SEO tool can run PCI and SEO checks together in the same request.
The Five Compliance Profiles
- Universal OWASP core: scans every payload for the SQL injection, command injection, and path traversal patterns catalogued in the OWASP Top 10:2025, and redacts any exposed bearer tokens or API keys, regardless of which other profiles are active.
- Fintech (PCI-DSS): detects primary account numbers (credit card numbers) using the Luhn checksum algorithm and redacts them in transit.
- Healthcare (HIPAA/FHIR): identifies and scrubs protected health information and personally identifiable information, such as Social Security numbers and dates of birth.
- SEO & Digital Marketing (GDPR/AEO): redacts raw IP addresses and validates SEO metadata against known limits — canonical URL structure, title length under 60 characters, description length under 150 characters — to prevent an agent from silently shipping content that hurts search indexing.
- Biorobotics Safety Interlock: checks mechanical G-code commands against physical deck boundaries and safe velocity envelopes, and automatically recommends a remediated, safe version of the command rather than just rejecting it outright.
| Profile | Standard | Catches | Action Taken |
|---|---|---|---|
| OWASP core | OWASP Top 10:2025 | SQLi, command injection, path traversal, exposed tokens | Redact / block |
| Fintech | PCI-DSS | Primary account numbers (Luhn-validated) | Redact |
| Healthcare | HIPAA / FHIR | PHI, PII — SSNs, dates of birth | Redact |
| SEO & Marketing | GDPR / AEO | Raw IPs, out-of-limit metadata | Redact / flag |
| Biorobotics | Internal safety spec | Deck-limit and velocity violations in G-code | Auto-remediate |
Live Test: Catching a Credential Leak and an Unsafe Command Together
The test payload was intentionally adversarial on two fronts at once: {"action": "G1 X240.0 Y10.0 F2000", "billing_card": "4242 4242 4242 4242"}, submitted with the pci,biorobotics profiles active. The server returned:
- Violations detected:
PCI_PAN_CREDENTIAL_LEAK,DECK_LIMIT_X_EXCEEDED, andEXCESSIVE_VELOCITY_CAVITATION_RISK. - Remediated payload: the card number replaced with
[REDACTED_PCI_PAN], the X coordinate clamped from 240.0 to the physical boundary at 200.0mm, and the feedrate reduced from F2000 to F500 to prevent fluid splashing. - Status:
REMEDIATED— the payload wasn't just flagged and rejected, it was returned in a corrected, safe-to-execute form.
That remediation-over-rejection behavior is the detail worth noting: a naive guard would simply block the unsafe request and leave the agent to figure out why. This one returns a corrected version alongside the violation list, which is a meaningfully different (and more useful) design for an agent that's expected to retry automatically.
Pairing With the Bio-Robotics Core Engine
This guard was built specifically to sit in front of the SEOSiri Bio-Robotics Core Engine, which translates biological data and EMG signals into G-code for physical actuation. The Bio-Robotics engine's own tools already apply deterministic math to keep outputs within physical limits — but the API Guard adds an independent, second layer of validation specifically for cases where a command reaches the hardware gateway through a different path than the Bio-Robotics engine's own tools, such as a direct or agent-modified payload. Running both together means physical safety limits are checked twice, by two independently maintained pieces of code, rather than relying on a single point of failure.
Who This Is For
If you're evaluating this rather than just reading about it, here's the honest breakdown of who gets the most out of it:
- Developers wiring up AI agents. If Claude Code, Cursor, or another MCP client is generating API calls on your behalf, this sits in front of that traffic as a local checkpoint you don't have to build yourself. One tool call, not five different libraries to integrate.
- Security and compliance teams. The value here isn't novelty, it's coverage of the boring, expensive mistakes — a credential in a log, a card number in a payload, a metadata field that silently tanks a page's SEO. Catching those before they leave the machine is cheaper than catching them in an audit.
- Biotech and robotics teams, especially anyone already running the Bio-Robotics Core Engine. The Biorobotics profile is a second, independent check on physical safety limits — worth having even if you trust your primary tooling, because independent checks are exactly what catch the bugs a single system misses.
Quickstart
# Install locally in editable development mode
pip install -e .
pytest tests/test_guard.py
# Or run directly from GitHub with zero setup (requires uv)
# — add this to your claude_desktop_config.json:
{
"mcpServers": {
"seosiri-api-guard": {
"command": "uv",
"args": ["run", "--github", "SEOSiri-Official/seosiri-api-guard-mcp-server", "src/main_server.py"]
}
}
}
Technical Specifications
- Communication protocol: Model Context Protocol JSON-RPC over stdio.
- Detection methods: OWASP Top 10 pattern scanning, Luhn checksum for PAN detection, regex-based PII/PHI identification.
- Verification: automated unit testing via pytest (
tests/test_guard.py). - Containerization: a Dockerfile is included for isolated runtime environments.
- Directory sync: a
glama.jsonfile drives the automatic Glama.ai listing sync. - Release: tagged
v1.0.0, "Initial Production Release," July 17, 2026. - License: MIT.
Listed on the Glama.ai MCP Directory
The server is published on Glama.ai's MCP directory alongside seosiri-biorobotics, and the source is available on GitHub. As with the Bio-Robotics engine, evaluating it doesn't require cloning the repository first — it can be tested directly through the listing.
Voice Search & Conversational Query Answers
What is the SEOSiri API Guard?
An open-source, stateless MCP server that inspects LLM-generated API payloads and hardware commands, redacting leaked credentials and unsafe data while automatically correcting commands that violate physical or compliance limits.
How many tools does it expose?
One — sanitize_and_validate_payload — which applies whichever compliance profiles are requested (OWASP, PCI-DSS, HIPAA, GDPR/SEO, or Biorobotics) in a single call, rather than requiring a separate tool per domain.
Does it just block unsafe requests, or fix them?
Both, depending on the violation. In live testing, an out-of-bounds G-code command was automatically remediated to a safe value rather than simply rejected, alongside redacting a leaked credit card number in the same call.
How does it detect credit card numbers?
Using the Luhn checksum algorithm, the standard validation method for primary account numbers, to identify PAN-formatted strings in a payload before they're transmitted.
Does it work with the Bio-Robotics Core Engine?
Yes — it's designed to run alongside it as an independent second safety layer specifically for the Biorobotics profile, checking physical deck limits and velocity envelopes on any G-code command that reaches the hardware gateway.
Is it open source?
Yes, under the MIT License, with the full source and test suite available on GitHub.
Can I run multiple compliance profiles at once?
Yes — profiles are passed as a comma-separated list (e.g. pci,biorobotics) and all requested checks run in the same call, so a single payload can be validated against multiple standards simultaneously.
Does this replace a real security audit?
No. It's a local, automated first line of defense against common, predictable mistakes — it doesn't replace a professional security review, penetration test, or compliance certification process.
Does it send my data anywhere?
No. It runs locally as an MCP server; payload inspection and redaction happen on your machine before anything is transmitted externally.
None of the five profiles here are novel security concepts — OWASP, PCI-DSS, HIPAA, and GDPR are all well-established standards on their own. What's new is having one local, open-source gatekeeper that applies whichever combination an AI agent's workload actually needs, in a single call, with remediation instead of just rejection. That's a small architectural choice with an outsized effect on how safely an agent can be trusted to act autonomously.
Explore or Contribute to the Project
The project is fully open-source. Explore the codebase, file an issue, or get involved in development directly on GitHub.
View on GitHub ➔ Sponsor the Project
