Marlo
Request a demo
  1. Marlo
  2. Docs
  3. Quickstart

Quickstart

This gets Marlo watching one MCP server in shadow mode. Nothing is blocked. At the end you will have a report of what would have been.

Step 1 — Install

Packaging is not final. Until it is, the install command is issued with your design partnership onboarding rather than published here, so that this page never tells you to run something that has moved.

Step 2 — Point your agent at MCP Guard

Change your MCP client configuration so the server URL is your MCP Guard endpoint instead of the upstream server. For local servers, change the launch command:

shell
# Before
some-mcp-server

# After
mcp-guard -- some-mcp-server

Step 3 — Declare intent

Optional, but strongly recommended. Without an intent record, Marlo can still label sources and record causality, but it cannot evaluate whether an action was within scope. Applications using the SDK should open each session with an intent declaration. Proxy-only deployments can start with source labeling and add intent later.

Step 4 — Run in observe mode

Default configuration is observe-only. Confirm with:

shell
mcp-guard status

Step 5 — Read the report

After a representative period (two weeks is typical), open The Board and review flagged sessions. Start with anything graded PROVABLE with a policy violation.

Related

Last reviewed 2026-08-04