# What is a guard in Provely?

> The interceptor that checks each tool call against the permission envelope before it runs. The Provely definition, with an example.

Canonical: https://provely.sh/glossary/guard  
Last reviewed: 2026-09-05  

**A guard is the interceptor that Provely puts between the agent and the provider. It compares each tool call with the confirmed permission envelope before the call runs. A call outside the envelope is refused, and the provider receives nothing.**

The SDK wraps an MCP client with `guardMcpClient`, and any dispatching caller with `guardDispatch`. The agent code does not change. The wrapper reads the tool name from each call, so one guard covers every tool of the server, including a tool that the server added after the process started.

The check compares two documents. It reads no text as an instruction, and it asks no language model. A declared schema that the checker cannot evaluate refuses the call, so the check fails closed.

The guard answers permission, and the completion contract answers completion. A guarded call to a provider that no skill covers runs and ends in UNVERIFIABLE, never VERIFIED. Read [what Provely refuses when your agent calls an MCP server](/mcp-guard).

## Read next

- [Read the definition of UNVERIFIABLE](https://provely.sh/glossary/unverifiable)
- [Read the definition of MCP server](https://provely.sh/glossary/mcp-server)
- [Read the definition of Permission envelope](https://provely.sh/glossary/permission-envelope)
- [See every glossary term](https://provely.sh/glossary)
- [Read how Provely works](https://provely.sh/how-it-works)