Guardrails for LLM output: pass / fail / review verdicts and one recommended action. Hosted or npm.
ai.overwing/mcp — Model Context Protocol (MCP) Server
The ai.overwing/mcp MCP server provides guardrails for LLM output, producing pass/fail/review verdicts with calibrated confidence. It is designed to return results in under 500 ms. The server is identified with the slug ai-overwing-mcp and focuses specifically on controlled LLM decisioning.
🛠️ Key Features
Guardrails for LLM output
Pass / fail / review verdicts
Calibrated confidence scoring
Response time target: under 500 ms
🚀 Use Cases
Enforcing decision guardrails for LLM-generated outputs
Automatically routing outcomes based on pass/fail/review verdicts
⚡ Developer Benefits
Consistent verdict outputs (pass, fail, review)
Confidence values that are calibrated
Low-latency responses (<500 ms)
⚠️ Limitations
Available behavior described only for LLM output guardrails and verdict generation; other MCP tools are not specified.
Guardrails for LLM output, as MCP tools.
Score any text for safety and quality. Get pass / fail / review verdicts with calibrated confidence, usually in under 500 ms.
Overwing is an API that checks what your model said before it ships. This package exposes it to any MCP-capable agent: Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, OpenAI's Agents SDK, and anything else that speaks the Model Context Protocol.
Real verdicts, not vibes. Every rule returns a typed answer, a probability, and a confidence. fail means a rule matched; review means it was unsure; pass means neither.
Prebuilt content-safety and outbound-message rule sets: toxicity, personal data, confidential leaks, self-harm, sexual content, severity. Or write your own rules in plain language.
Built for agents. Sign up, pay, evaluate, rotate keys, and cancel, all as JSON. No CAPTCHA, no browser required. See overwing.ai/llms.txt.
Try it without installing anything: paste text into the console at overwing.ai.
Hosted, no install
The same 27 tools are served at https://overwing.ai/mcp (Streamable HTTP). Point any client that takes a remote MCP URL at it:
bash
claude mcp add --transport http overwing https://overwing.ai/mcp
No key is needed for evaluate, atlas_lookup, atlas_summary, list_plans and the three beacon_ tools. For the rest, send Authorization: Bearer ow_live_... on the connection.
Install
It works with no API key: evaluate and atlas_lookup each run 10 times a day free, and text sent without a key is not stored. For more, get a key at overwing.ai/login, or let your agent sign itself up:
Set OVERWING_BASE_URL to point at a self-hosted deployment. Requires Node 20+.
For Overwing Tower, set OVERWING_AGENT_KEY=ow_agent_... to operate as an existing agent. Without it, tower_create_agent mints a key with the organization key and keeps it in memory for the session.
evaluate, atlas_lookup, atlas_summary and list_plans work with no key at all.
The text can be in any language. It was tested on 2026-09-29 in Spanish, Portuguese, French, German, Japanese, Simplified Chinese, Korean, Arabic and Hindi: a small test, not a benchmark. Results come back in English.
Tools
Tool
What it does
evaluate
Score one text against a rule set. Returns the verdict, a recommended_action (block, redact, review, or allow), aggregate score, confidence, latency, and per-rule results with each rule's action. Takes an optional context object (recipient, channel, ownership) that context-aware rule sets such as outbound-message read, and store: false to run the check without keeping the text.
evaluate_batch
Score up to 50 texts in one call, with a summary and per-item verdicts and recommended actions.
list_rule_sets · get_rule_set · create_rule_set
Browse the prebuilt set or define your own rules: yes/no questions, classifications, or scored scales.
get_evaluation · list_evaluations
Read stored results, filter by verdict or rule set, page with a cursor.
atlas_lookup
Overwing Atlas: say what a User-Agent string claims to be and whether the claim can be trusted (Web Bot Auth, spoofable string, or unattributable). Works with no key, 10 a day; 100 a day with a free key.
atlas_agents · atlas_summary
Search the registry of AI crawlers, fetchers and browser agents; get traffic shares, sector field-scan headlines, and the agent-spending summary.
beacon_start · beacon_report · beacon_sample
Overwing Beacon: is a site reachable by agents? Checks robots.txt, llms.txt, the MCP server card, endpoint and Registry listing, the A2A agent card and OpenAPI, and how the home page reads to a model. beacon_start returns a card checkout link ($5) and an id; beacon_report returns the report once paid; beacon_sample is a real report, free. Agents with a wallet pay $1 over x402 instead. No key.
Overwing Tower setup, with the organization key: load the starter order-entry workflow, then mint a scoped agent identity. The new agent key is used for the rest of the session.
Overwing Tower operations, with the agent key: see which operations you may call and their input schemas, ask how a request would be ruled, submit it (executed, pending human review, or rejected), poll it, undo it.
tower_get_receipt · tower_verify_receipts
Read a signed receipt, or recompute every hash and signature in the chain.
get_usage · whoami · list_plans
Today's quota, the org behind the key, and the public plan catalog.
The overwing://guide resource returns the full plain-text API guide.
Data handling and security
What this server does on your machine: it reads three environment variables (OVERWING_API_KEY, OVERWING_AGENT_KEY, OVERWING_BASE_URL) and makes HTTPS requests to the Overwing API. It reads no files, runs no commands, and talks to no other host. It has two runtime dependencies (@modelcontextprotocol/sdk, zod), and the whole server is one file: src/index.ts.
What happens to text you evaluate:
It is sent to the Overwing API, and from there to TypeSafe, whose Jev model produces the verdict. It is not used to train models.
Without a key the text is never stored.
With a key the text, context and verdict are stored so you can read them back with get_evaluation, until you delete them. To change that:
pass store: false to evaluate or evaluate_batch to keep no text or context for that call;
set store_inputs: false on the organization (PATCH /api/v1/org, or the dashboard) to keep none at all;
set retention_days on the organization to delete evaluations after that many days.
Traffic is encrypted in transit (TLS) and the database is encrypted at rest (AES-256).
Give your agent a restricted key. A key with scope evaluate can run checks and read rule sets, and cannot read stored evaluations, change rule sets, manage keys, webhooks or billing, or delete anything:
Overwing is a young service and has not had an independent security audit. The full picture, including subprocessors and what we have not done, is at overwing.ai/security; the privacy policy is at overwing.ai/privacy. To report a vulnerability, see SECURITY.md.
Example
Ask your agent:
Check this reply before I send it: "Reach me at dana@example.com or 555-0142 to sort out the refund."
Each rule has a fail condition, an optional review threshold, and a weight.
fail: a rule's fail condition matched. Block it, redact it, or regenerate.
review: nothing failed, but a rule's confidence was below its threshold. Route to a person or a slower model.
pass: everything else.
Every rule also carries an action (block, redact, or review), and the response rolls them up into one recommended_action: block beats redact beats review beats allow. Branch on that field. Pass a context object (recipient, channel, owns_contact_info) with the outbound-message rule set and its rules read it, so a customer's own phone number in a reply to that customer is not flagged.
aggregate_score is 0 to 1 (pass = 1, review = 0.5, fail = 0 per rule, weighted). confidence is the minimum across rules.
Pricing
Free: 250 evaluations a day. Paid plans from $29/month. Every plan includes every endpoint, custom rule sets, webhooks, and the dashboard. Full details at overwing.ai/#pricing or GET https://overwing.ai/api/v1/plans.
Overwing organization key (ow_live_...). Optional: evaluate and atlas_lookup work without it, 10 a day each. Needed for higher limits, rule sets and Tower setup. Get one at https://overwing.ai/login or POST https://overwing.ai/api/v1/signup
OVERWING_AGENT_KEYsecret
Optional Overwing Tower agent key (ow_agent_...). Without it, the tower_create_agent tool mints one for the session
OVERWING_BASE_URL
Override the API base URL for self-hosted deployments (default https://overwing.ai)
