Every tool call gets stamped before it runs.

A free local model checks the call. When it is unsure, Gemini does, on your key. You see what each one catches, and what it misses.

Try the deskPlug into your agentGet the model
Loading the measured numbers.

One call in. One verdict out.

Scroll through what happens to a single proposed call.

1The agent proposes

Role, policy, session facts, the conversation so far and one tool call. Tool output counts as untrusted data, never as instructions.

2The local adapter reads it

Gemma 4 E4B with a LoRA adapter, running on your machine for free. It also reports how sure it is.

3Sure, or ask Gemini?

Confident allows stay local. Anything the adapter doubts goes to Gemini with your own key. Nothing else is billed.

4A verdict you can audit

Allow or block, one of eight categories, and a one-sentence reason you can log.

The inspection desk

Edit the call and the policy. The instant answer is a keyword baseline running in your browser: a floor, not the real guard. Paste your own Gemini key for the real prompt. The request goes from your browser to Google and nowhere else.

The cached Gemma verdicts on the presets were measured on the 8-bit adapter. Hosted calls bill your own Google account.

Policy test suite

Save the current call with the verdict you expect, run the suite, export the report. Stored only in your browser.

Pay only for doubt.

The adapter's confidence is the signal. Move the thresholds and replay Project A's real agent traffic (held-out half; the defaults were fit on the other half).

The honest scoreboard.

Project A's real agent traffic. Dots are measured rates, whiskers are 95% family-clustered bootstrap intervals. The free model is clearly weaker than hosted Gemini. Use it as a cheap first pass, never as the only gate for destructive, financial or data-export actions.

Full tables and caveats: RESULTS.md. The adapter is tuned mainly to cut false positives, not to match Gemini on recall.

Plug it into your agent.

A stdio MCP server with check_tool_call, explain_categories and cascade_stats. Backends: keyword (default), local, gemini (your key), cascade.

git clone https://github.com/brej-29/toolcall-guard
cd toolcall-guard
uv run --no-project --with "mcp<2" python -m tcg.mcp_server
{
  "mcpServers": {
    "toolcall-guard": {
      "command": "uv",
      "args": ["run", "--no-project", "--with", "mcp<2", "python", "-m", "tcg.mcp_server"],
      "cwd": "/path/to/toolcall-guard",
      "env": { "GUARD_BACKEND": "keyword" }
    }
  }
}

The server starts and lists its tools. Use inside each client is untested here.

Questions.

Is this a security boundary?

No. It is a pre-execution check. Pair it with least-privilege tools and human review for destructive actions.

Why bother if Gemini is better?

Cost, privacy and offline use. The cascade measures how much of Gemini's quality you keep while sending fewer calls to it.

Where does my API key go?

Only to Google's API, from your browser, and only when you press Check with Gemini. This site has no server.