MCP for Claude, ChatGPT and Cursor

Planned

The MCP server (zunder-guard-mcp) ships with Guard 1.0, which is not released yet. The tools and flags below are the ones built; the client configs follow each client’s own docs, cited at the bottom, read 6 Oct 2026.

A prompt is not a limit. A model can misread a number, repeat itself, or be talked out of an instruction. Guard’s MCP server gives an agent tools that cannot break your limits, because every order still passes the same nine rules as any bot’s, in Guard, on your machine.

The tools

Tool	What it does
account_overview	equity, positions with the stops that protect them, open orders, Guard’s state
limits	your nine rules and the risk state (active, halted for the day, stopped, kill switch)
preview_order	“what would you allow for this trade?”: the size from the stop, a resize and the rule that bound it, or the veto, without sending
place_order	an entry with its stop (or Guard’s default stop), through the nine rules; returns Guard’s verdict and the venue’s reply
move_stop	move a stop; only tighter is accepted
close_position	reduce or close; never blocked
cancel_order	cancel one order; Guard keeps a position’s last stop
recent_decisions	Guard’s latest verdicts and why
kill_switch	pull the kill switch; needs confirm: true

There is no tool to raise a limit, change the stop policy, change leverage, resume after a halt, release the kill switch, move funds or send a raw request. Those need you, at the machine running Guard.

Prices and sizes are decimal strings ("58800", "0.01"); a size can be "max", and a stop can be "guard_policy". Every refusal comes back with a code and a plain reason, and says whether anything was sent.

Example. You ask the agent to “go long BTC, stop 2% below”. It calls preview_order and gets back: “resize: 0.02553 BTC, bound by the loss at the stop (2% of equity)”. It can report that to you; it cannot change it.

Before you start

1. Guard is running (zunder-guard run).

2. The agent has its own client key from zunder-guard init, saved in a file only you can read:

   mkdir -p ~/.config/zunder-guard && umask 077
   cat > ~/.config/zunder-guard/mcp-client.key     # paste the key, Enter, Ctrl-D

   The key is never a command-line argument or an environment variable. Without one, the server is read-only.

3. Your Guard’s kill file is its state_dir plus /kill.

The configs below start the program without a shell, so write absolute paths (no ~).

Flag	Default
--network	paper	paper, testnet or mainnet: orders are refused unless Guard runs the same
--key-file		the client key file (mode 600)
--key-stdin		the client key on the first line of standard input
--kill-file		Guard’s state_dir/kill, for kill_switch
--guard-url	http://127.0.0.1:8547	Guard’s address; this machine only
--confirm-account		mainnet only, and required there: the account Guard trades

Claude Desktop

Edit claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json; Windows: %APPDATA%\Claude\claude_desktop_config.json), then restart Claude Desktop.

{
  "mcpServers": {
    "zunder-guard": {
      "command": "/usr/local/bin/zunder-guard-mcp",
      "args": [
        "--network", "testnet",
        "--key-file", "/Users/you/.config/zunder-guard/mcp-client.key",
        "--kill-file", "/Users/you/guard-state/kill"
      ]
    }
  }
}

Claude Code

claude mcp add --scope user zunder-guard -- /usr/local/bin/zunder-guard-mcp \
  --network testnet \
  --key-file /Users/you/.config/zunder-guard/mcp-client.key \
  --kill-file /Users/you/guard-state/kill

The -- separates Claude Code’s options from the server’s command. For one project, put the same in .mcp.json:

{
  "mcpServers": {
    "zunder-guard": {
      "type": "stdio",
      "command": "/usr/local/bin/zunder-guard-mcp",
      "args": ["--network", "testnet", "--key-file", "/Users/you/.config/zunder-guard/mcp-client.key", "--kill-file", "/Users/you/guard-state/kill"]
    }
  }
}

Cursor

.cursor/mcp.json in a project, or ~/.cursor/mcp.json for all projects:

{
  "mcpServers": {
    "zunder-guard": {
      "command": "/usr/local/bin/zunder-guard-mcp",
      "args": ["--network", "testnet", "--key-file", "/Users/you/.config/zunder-guard/mcp-client.key", "--kill-file", "/Users/you/guard-state/kill"]
    }
  }
}

OpenAI Agents SDK

from agents import Agent, Runner
from agents.mcp import MCPServerStdio

async with MCPServerStdio(
    name="zunder-guard",
    params={
        "command": "/usr/local/bin/zunder-guard-mcp",
        "args": ["--network", "testnet",
                 "--key-file", "/Users/you/.config/zunder-guard/mcp-client.key",
                 "--kill-file", "/Users/you/guard-state/kill"],
    },
    cache_tools_list=True,
) as guard:
    agent = Agent(name="Trader", instructions="Preview before placing.", mcp_servers=[guard])
    result = await Runner.run(agent, "What would Guard allow for a BTC long with a stop at 58800?")

LangGraph

from langchain_mcp_adapters.client import MultiServerMCPClient

client = MultiServerMCPClient({
    "zunder-guard": {
        "transport": "stdio",
        "command": "/usr/local/bin/zunder-guard-mcp",
        "args": ["--network", "testnet", "--key-file", "/Users/you/.config/zunder-guard/mcp-client.key"],
    }
})
tools = await client.get_tools()

ChatGPT

ChatGPT’s connectors reach MCP servers over the internet (SSE or streamable HTTP); a local server started from a command does not work there. Guard runs on your machine and listens on localhost only. So ChatGPT is not supported directly.

We do not recommend exposing Guard to the internet with a tunnel to make it work. A connection through the relay is being considered; it is not planned yet.

What the MCP server needs, and what it cannot do

zunder-guard-mcp talks only to your running Guard on your machine. It holds no API wallet key: that stays in Guard. Its client key only identifies the agent to Guard; the venue would refuse it.

It can sign three kinds of request (an order, a cancel, a change to an order), and Guard judges each one again. It refuses to send anything when Guard runs another network than the one you named, when its key is not one of Guard’s clients or is known to Hyperliquid, or when the address does not answer like a Guard. A client key must be a fresh key: never approve it as an API wallet. Text that comes back from Guard or the venue is passed to the model as quoted data, never as instructions, and tool calls are rate-limited (order requests: 4 at once, then 10 a minute). The kill switch is never rate-limited.

Sources

• Claude Desktop: modelcontextprotocol.io, “Connect to local MCP servers”.
• Claude Code: code.claude.com/docs/en/mcp.
• Cursor: cursor.com/docs/context/mcp.
• OpenAI Agents SDK: openai.github.io/openai-agents-python/mcp.
• LangGraph: langchain-mcp-adapters.
• ChatGPT: OpenAI, “ChatGPT Developer mode”.