Overwing

Guardrails for LLM output, as MCP tools.
Score any text for safety and quality. Get pass / fail / review verdicts with calibrated confidence, usually in under 500 ms.

简体中文 · 日本語 · 한국어

Overwing is an API that checks what your model said before it ships. This package exposes it to any MCP-capable agent: Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, OpenAI's Agents SDK, and anything else that speaks the Model Context Protocol.

• Real verdicts, not vibes. Every rule returns a typed answer, a probability, and a confidence. fail means a rule matched; review means it was unsure; pass means neither.
• Prebuilt content-safety and outbound-message rule sets: toxicity, personal data, confidential leaks, self-harm, sexual content, severity. Or write your own rules in plain language.
• Built for agents. Sign up, pay, evaluate, rotate keys, and cancel, all as JSON. No CAPTCHA, no browser required. See overwing.ai/llms.txt.

Try it without installing anything: paste text into the console at overwing.ai.

Hosted, no install

The same 39 tools are served at https://overwing.ai/mcp (Streamable HTTP). Point any client that takes a remote MCP URL at it:

claude mcp add --transport http overwing https://overwing.ai/mcp

No key is needed for evaluate, atlas_lookup, atlas_summary, list_plans, create_account, the three beacon_ tools, and preflight_verdict, preflight_report, preflight_record and preflight_overview. For the rest, send Authorization: Bearer ow_live_... on the connection.

Install

It works with no API key: evaluate and atlas_lookup each run 10 times a day free, and text sent without a key is not stored. For more, get a key at overwing.ai/login, or let your agent make its own account with the create_account tool. That account has no email: nothing is sent to anyone, and the key is returned once. The same call from a shell:

curl -X POST https://overwing.ai/api/v1/signup

Put the key in OVERWING_API_KEY. An account with no email starts at 50 evaluations a day; proving a domain (prove_domain, verify_domain) raises it to the normal free limits and makes a lost key recoverable.

Claude Code

claude mcp add overwing -e OVERWING_API_KEY=ow_live_... -- npx -y overwing-mcp

Claude Desktop, Cursor, Windsurf, VS Code (any JSON-configured client)

{
  "mcpServers": {
    "overwing": {
      "command": "npx",
      "args": ["-y", "overwing-mcp"],
      "env": { "OVERWING_API_KEY": "ow_live_..." }
    }
  }
}

Set OVERWING_BASE_URL to point at a self-hosted deployment. Requires Node 20+.

For Overwing Tower, set OVERWING_AGENT_KEY=ow_agent_... to operate as an existing agent. Without it, tower_create_agent mints a key with the organization key and keeps it in memory for the session.

evaluate, atlas_lookup, atlas_summary and list_plans work with no key at all.

For Overwing Preflight, preflight_check needs OVERWING_API_KEY; the other preflight_ tools need no key. No Preflight tool takes a private key, and none should ever be given one.

The text can be in any language. It was tested on 2026-09-29 in Spanish, Portuguese, French, German, Japanese, Simplified Chinese, Korean, Arabic and Hindi: a small test, not a benchmark. Results come back in English.

Tools

The overwing://guide resource returns the full plain-text API guide.

Data handling and security

What this server does on your machine: it reads three environment variables (OVERWING_API_KEY, OVERWING_AGENT_KEY, OVERWING_BASE_URL) and makes HTTPS requests to the Overwing API. It reads no files, runs no commands, and talks to no other host. It has two runtime dependencies (@modelcontextprotocol/sdk, zod), and the whole server is one file: src/index.ts.

What happens to text you evaluate:

• It is sent to the Overwing API, and from there to TypeSafe, whose Jev model produces the verdict. It is not used to train models.
• Without a key the text is never stored.
• With a key the text, context and verdict are stored so you can read them back with get_evaluation, until you delete them. To change that:
  • pass store: false to evaluate or evaluate_batch to keep no text or context for that call;
  • set store_inputs: false on the organization (PATCH /api/v1/org, or the dashboard) to keep none at all;
  • set retention_days on the organization to delete evaluations after that many days.
• A Solana transaction you check with preflight_check is sent to the Overwing API with its policy, and simulated against a Solana node. What is published is the verdict: its id, decision, reason codes, programs and the transaction's digest. Never the wallet, the amounts or the transaction. No private key is ever sent, and the tool does not accept one.
• Traffic is encrypted in transit (TLS) and the database is encrypted at rest (AES-256).

Give your agent a restricted key. A key with scope evaluate can run checks and read rule sets, and cannot read stored evaluations, change rule sets, manage keys, webhooks or billing, or delete anything:

curl -X POST https://overwing.ai/api/v1/api-keys \
  -H "Authorization: Bearer ow_live_..." -H "Content-Type: application/json" \
  -d '{"name":"agent","scope":"evaluate"}'

Overwing is a young service and has not had an independent security audit. The full picture, including subprocessors and what we have not done, is at overwing.ai/security; the privacy policy is at overwing.ai/privacy. To report a vulnerability, see SECURITY.md.

Example

Ask your agent:

Check this reply before I send it: "Reach me at dana@example.com or 555-0142 to sort out the refund."

It calls evaluate and gets back:

Verdict: FAIL  score=0.82  confidence=0.97  251ms
  toxicity: pass (answer="safe", confidence=1)
  pii_detected: fail (answer=true, confidence=0.98)
  self_harm: pass (answer=false, confidence=1)
  sexual_content: pass (answer="none", confidence=1)
  severity: pass (answer=0.03, confidence=0.97)

How verdicts work

Each rule has a fail condition, an optional review threshold, and a weight.

• fail: a rule's fail condition matched. Block it, redact it, or regenerate.
• review: nothing failed, but a rule's confidence was below its threshold. Route to a person or a slower model.
• pass: everything else.

Every rule also carries an action (block, redact, or review), and the response rolls them up into one recommended_action: block beats redact beats review beats allow. Branch on that field. Pass a context object (recipient, channel, owns_contact_info) with the outbound-message rule set and its rules read it, so a customer's own phone number in a reply to that customer is not flagged.

aggregate_score is 0 to 1 (pass = 1, review = 0.5, fail = 0 per rule, weighted). confidence is the minimum across rules.

Pricing

Free: 250 evaluations a day. Paid plans from $29/month. Every plan includes every endpoint, custom rule sets, webhooks, and the dashboard. Full details at overwing.ai/#pricing or GET https://overwing.ai/api/v1/plans.

Links

• Website and live demo: overwing.ai
• API reference: overwing.ai/docs
• OpenAPI: overwing.ai/api/v1/openapi.json
• Guide for agents: overwing.ai/llms.txt
• Support: support@overwing.ai

Development

npm install
npm run build
OVERWING_API_KEY=ow_live_... node dist/index.js

MIT © Overwing. Verdicts are produced by TypeSafe's Jev System One model; Overwing is not affiliated with TypeSafe.