Free · No sign-in · MCP

Let Claude ask Rollcage first.

Rollcage's MCP server gives Claude the Guard's rules as tools. Before it runs a risky command, opens a file or sends data to a site, Claude can check whether it would be blocked, needs your approval, or is fine, and why.

https://rollcage.app/mcp

Streamable HTTP. Works with Claude, Claude Code, Cursor, Codex CLI and Gemini CLI.

Try it

This box calls check_command on the live server, exactly as Claude does. The rules are the open-source rollcage-guard's, ported to run on the server and tested against the original.

Pick an example or type a command. Nothing runs: the server only reads it.

Add it

Claude (web and desktop)

Settings → Connectors → Add custom connector. Name it Rollcage and paste the URL. Leave the OAuth fields empty: there's nothing to sign in to.

https://rollcage.app/mcp

Claude Code

Add it for every project:

claude mcp add --transport http --scope user rollcage https://rollcage.app/mcp

Claude Code plugin

Or install it as a plugin from the rollcage-guard repository:

/plugin install rollcage --marketplace nmaties/rollcage-guard

Cursor

In ~/.cursor/mcp.json:

{
  "mcpServers": {
    "rollcage": {
      "url": "https://rollcage.app/mcp"
    }
  }
}

Codex CLI

From a terminal:

codex mcp add rollcage --url https://rollcage.app/mcp

Gemini CLI

In ~/.gemini/settings.json:

{
  "mcpServers": {
    "rollcage": {
      "httpUrl": "https://rollcage.app/mcp"
    }
  }
}

The tools

All read-only. Claude picks them when they fit; you can also ask for them by name.

check_command
Block, ask or allow for a shell command, with the reason. Secret files, environment dumps, rm -rf ~, git reset --hard, force pushes, DROP DATABASE, curl | sh, cloud deletes, pushes to main, exfiltration sites.
“Is `git clean -fdx` safe to run here?”
check_file
Whether paths are secret files an agent shouldn't open: .env files, keys, certificates, cloud credentials, Terraform state. .env.example is fine.
“Which of these files can you read without seeing secrets?”
check_url
Whether a URL or host is a paste, file-drop or tunnel site, the usual way keys and code leave a machine.
“Can I send this log to webhook.site?”
list_rules
The full default rule set, so Claude can explain why something was blocked.
“What does Rollcage block by default?”
install_guard
How to turn the same rules into a hook that checks every tool call, for Claude Code, Codex CLI, Cursor and Gemini CLI.
“Set up the Rollcage guard for Claude Code and Cursor.”
search_docs · get_doc
Rollcage's guides to running agents safely: hooks, permissions, sandboxing, YOLO mode, undo, usage and cost.
“How do Claude Code hooks work?”
rollcage_info
The latest version and what changed, price, requirements and links.
“What's new in Rollcage?”

Questions

Does it need an account or an API key?: No. The server is public and has no sign-in. Add the URL and it works.
Can it see or change my files?: No. It runs on rollcage.app, not on your computer. It only reads the command, path or URL Claude sends it and answers with a verdict. Nothing is run and nothing is stored.
Does it stop Claude from running a command?: No, it advises. Claude asks it and is told to treat a block as a no. To enforce the rules on every tool call, install the open-source rollcage-guard hook or the Rollcage app: the install_guard tool walks you through it.
Is it the same as the Guard in the app?: It runs the rules of the open-source rollcage-guard with their default settings. The local hook also reads what a git commit or push would send and blocks API keys and secret files; that needs your repository, so the MCP server can't do it.

How the Guard works rollcage-guard on GitHub Download Rollcage