Guards

Guards inspect request and response content on tool and model connections. Filters can redact, omit, or block matching text. Validators block tool traffic when structured checks fail.

Refer to Guards for Filters, Validators, and assignment. Editing a Filter or Validator deploys a new active version; assigned connections pick it up on the next gateway sync. All tools require workspace context.

Filters

dome_guards_list_filters

List the workspace's Filters, each with its active version and config.

dome_guards_get_filter

Fetch one Filter's active version and config.

dome_guards_list_filter_versions

List a Filter's version history, newest first. Rollback-produced versions cite their source version id.

dome_guards_create_filter

Create a Filter — its first active version. Supply the config via the convenience params (text-only) or config_json (any kind).

The convenience params build at most two components — a redact component and a block component, redact ordered first — and only produce text Filters. Pass config_json to author a JSON Filter or a multi-component text chain.

JSON Filter config

{
  "json": {
    "components": [
      {
        "field_actions": [
          { "matcher": { "key": "ssn" },   "action": "FILTER_ACTION_OMIT" },
          { "matcher": { "key": "email" }, "action": "FILTER_ACTION_REDACT" },
          { "matcher": { "key": "card" },  "action": "FILTER_ACTION_BLOCK" }
        ]
      }
    ]
  }
}

BLOCK withholds the whole message. OMIT removes the key and value. REDACT rewrites the value with a redaction sentinel. When multiple actions target the same key: BLOCK > OMIT > REDACT.

dome_guards_update_filter

Edit metadata in place (new_name, description), or deploy a new active version by passing any config param. History is preserved.

Pass at least one of new_name, description, or a config param.

dome_guards_rollback_filter

Roll a Filter back to an earlier version. The target version's config is copied forward into a new active version.

dome_guards_delete_filter

Hard-delete a Filter and its connection assignments.

Filter assignment

dome_models_guards_filters_list

List the text Filters assigned to a model connection, in chain order, grouped by direction.

dome_models_guards_filters_set

Replace the entire ordered Filter chain for one direction on a model connection. Only text-kind Filters may be assigned.

response filters completions the agent receives. request filters the outbound prompt before dispatch to the model provider — a match can redact or block the call.

dome_tools_guards_filters_list

List the JSON Filters assigned to an MCP server (tool) connection, in chain order, grouped by direction.

dome_tools_guards_filters_set

Replace the entire ordered Filter chain for one direction on a tool connection. Only json-kind Filters may be assigned.

request filters run over tool arguments before the call reaches the upstream MCP server — matched fields are redacted or omitted, or the whole call is blocked. response filters run over the tool result before the agent sees it.

Validators

dome_guards_list_validators

List the workspace's Validators, each with its active version and kind.

dome_guards_get_validator

Fetch one Validator's active version and config.

dome_guards_list_validator_versions

List a Validator's version history, newest first.

dome_guards_create_validator

Create a Validator — its first active version.

Kind (tool_request or tool_response) is derived from the config arm and is immutable.

Example config

{
  "toolRequest": {
    "json": {
      "requiredPaths": ["user_id"],
      "maximumSize": 4096
    }
  }
}

dome_guards_update_validator

Edit metadata in place, or pass config_json to deploy a new active version.

Pass at least one of new_name, description, or config_json.

dome_guards_rollback_validator

Roll a Validator back to an earlier version.

dome_guards_delete_validator

Hard-delete a Validator and its connection assignments.

Validator assignment

dome_tools_guards_validators_list

List Validators assigned to a tool connection, grouped by direction.

dome_tools_guards_validators_add

Attach Validators to one direction on a tool connection. Response Validators are MCP-only.

dome_tools_guards_validators_remove

Detach Validators from one direction on a tool connection.

Next steps

Create and assign Filters and Validators from Govern. Catalogs cover windows, path syntax, and Validator conditions:

• Configure Guards
• Guards concept
• Guards reference