# Amazon Bedrock Guardrails vs ShieldGemma

> Amazon Bedrock Guardrails scores 77.4 (BB) to ShieldGemma's 54 (C) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma
- Markdown: https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md (~6,100 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Amazon Bedrock Guardrails scores 77.4 (BB) on agent readiness against ShieldGemma's 54 (C), and leads in 6 of 7 scored categories. ShieldGemma leads on payments & pricing. Both do content moderation.

- Amazon Bedrock Guardrails: grade BB, 77.4/100, rank #29 of 1510. Markdown https://www.anchorterminal.com/tools/amazon-bedrock-guardrails.md · JSON https://www.anchorterminal.com/api/v1/tools/amazon-bedrock-guardrails.json
- ShieldGemma: grade C, 54/100, rank #927 of 1510. Markdown https://www.anchorterminal.com/tools/shieldgemma.md · JSON https://www.anchorterminal.com/api/v1/tools/shieldgemma.json
- Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md
- All 155 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md

## Which one, for what

### Amazon Bedrock Guardrails (BB)

Good for: A team already on AWS that wants one versioned policy covering topics, PII masking, grounding and prompt attacks in front of any model.

Ahead on:
- Reliability, 75 against 46
- Schema & documentation, 92 against 56
- Agent ergonomics, 93 against 72
- Security & auth, 96 against 53
- Maintenance & community, 65 against 40
- Transparency & trust, 70 against 54

Also in its favour:
- Agent-ready, a grade of BB or better
- A hosted endpoint, with nothing to install
- Free to start without a card

Watch for: Per-policy billing, so four paid policies on one request cost four times, and no Guardrails-specific free tier

### ShieldGemma (C)

Good for: Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.

Ahead on:
- Payments & pricing, 52 against 30

Also in its favour:
- No key needed to call it

Watch for: No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy


## Why the edge

### Security & auth: Amazon Bedrock Guardrails +43

- Amazon Bedrock Guardrails (96): IAM with SigV4, roles and short-lived credentials, and policies can name a single guardrail ARN (30). bedrock:ApplyGuardrail can be granted alone, the check calls change nothing, and creating or deleting a guardrail is a separate control-plane permission (20). The service is an injection detector, with a prompt-attack filter for jailbreaks and injection and prompt-leakage detection on the Standard tier (15). ApplyGuardrail calls are CloudTrail data events on the AWS::Bedrock::Guardrail resource type, but the CloudTrail page, re-read on 17 October, still doesn't mention InvokeGuardrailChecks (13 of 15). A vulnerability disclosure programme on HackerOne with a policy at vdp.aws.security, public security bulletins, and Amazon Bedrock in SOC scope on AWS's list updated 11 August 2026 (Bedrock Marketplace excluded). The aws.amazon.com security.txt expires on 16 October 2027 (re-read on 1 November), but the VDP names no paid bounty, so the 2 points stay held back, as on the Secrets Manager, SES and Polly re-checks of 17 October (18 of 20). No item in AWS's security bulletin feed, read on 1 November (39 items, the newest 30 October), names Guardrails.
- ShieldGemma (53): Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.

### Schema & documentation: Amazon Bedrock Guardrails +36

- Amazon Bedrock Guardrails (92): The SDKs are generated from AWS's published service models, and the API reference gives every field with type, pattern and enum (25). The user guide has an llms.txt, re-read on 6 October with 67 lines naming guardrails, and serves .md pages (10). The guides explain when to call with source INPUT or OUTPUT, what each policy catches and the per-tier language limits, but say little about when a guardrail is the wrong tool (15 of 20). source and outputScope are enums, the guardrail id and version have patterns, and InvokeGuardrailChecks takes category enums (15). Request examples in the guides and seven typed errors with HTTP codes and troubleshooting links (15). Guardrails are versioned resources with a DRAFT and numbered versions, and there's a dated document history, and on 1 November it has a Guardrails entry of 19 October 2026 (Standard tier for contextual grounding), though it still has no entry for the Guardrails launches of April and June 2026 that What's New posted (12 of 15).
- ShieldGemma (56): Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.

### Reliability: Amazon Bedrock Guardrails +29

- Amazon Bedrock Guardrails (75): AWS Health Dashboard with per-service, per-region history and RSS feeds (20). AWS's dashboard history file, re-read on 1 November, lists Amazon Bedrock in the Middle East (UAE) me-central-1 and Middle East (Bahrain) me-south-1 multi-service events, open since 1 and 2 March 2026 at disruption status. On 15 September 2026, inside the 90-day window, AWS said it can't restore resources and data hosted only in me-south-1 or in the mec1-az2 zone. No update to either event after 15 September and no new Bedrock event since 4 October (the newest event in the file is the API Gateway us-west-2 one of 30 October, which doesn't list Bedrock). The only Bedrock-specific entry is a model access revocation on 13 June 2026, outside the window, and the eu-south-2 packet-loss event of 4 October lists Bedrock AgentCore but not Bedrock. One major event, read as the S3, Secrets Manager and Polly re-checks read it (10). Quotas published per Region in the AWS General Reference, per the 17 October check, not re-read on 1 November, 100 ApplyGuardrail requests a second in nine main Regions and 25 elsewhere, text units a second per policy and tier, and 1,500 InvokeGuardrailChecks calls a minute (15). The InvokeGuardrailChecks guide, per the 17 October check, says to retry 429 and 503 with exponential backoff and 500 as is (15). The Bedrock SLA, last updated 4 October 2023 (per the 17 October check), promises 99.9 per cent a region but covers "the Amazon Bedrock APIs for models" and doesn't name Guardrails (5 of 10, our call). ApplyGuardrail and InvokeGuardrailChecks carry no preview label (10).
- ShieldGemma (46): Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.

### Maintenance & community: Amazon Bedrock Guardrails +25

- Amazon Bedrock Guardrails (65): Read by the listing's own shapes in the bedrock and bedrock-runtime service models, as this run's amazon-s3 re-check read models/s3. The bedrock model changed on 20 October 2026, adding a Standard or Classic tier for contextual grounding checks and raising the regex filters a guardrail can hold from 10 to 30. The document history (19 October) and What's New (20 October) announced the Standard tier for contextual grounding, 12 days before 1 November (30, up from 10, cause product). In the 90 days from 3 August we found two dated Guardrails changes, the 20 October one and wider name patterns for Automated Reasoning policy definitions on 30 September, which the 17 October check didn't count. Other bedrock and bedrock-runtime changes in the window (31 July, 24 August, 4 September) touch no guardrail shape, so fewer than three (0). Public document history and What's New, and support through re:Post and AWS Support, but the history still misses the April and June 2026 launches (10 of 15). Current SDKs, boto3 1.43.123 on 30 October 2026 (per its release tag) and the @aws-sdk/client-bedrock-runtime client with 21,122,074 npm downloads in the week to 29 October (15). SDKs ship near-daily and support Python 3.10 and later (10). 30 + 0 + 10 + 15 + 10 = 65.
- ShieldGemma (40): Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.

### Payments & pricing: ShieldGemma +22

- Amazon Bedrock Guardrails (30): No x402, MPP or L402 (0). Per-policy prices per 1,000 text units published without a login, unchanged on 1 November (20). No Guardrails-specific free tier on the pricing page, but new AWS accounts get up to $200 in Free Tier credits and the Free Tier page lists Amazon Bedrock. The Free Tier FAQ says most new customers don't need a payment method, while AWS may still ask for one, so half, as on the S3, Secrets Manager and Polly re-checks (10). A person signs up in a browser and sets up IAM (0).
- ShieldGemma (52): Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.

### Agent ergonomics: Amazon Bedrock Guardrails +21

- Amazon Bedrock Guardrails (93): outputScope INTERVENTIONS keeps the response to what fired, FULL returns every assessment, and usage says how many text units each policy billed (25). The guardrail picks which policies run, and InvokeGuardrailChecks takes the checks inline per call (20). Typed exceptions with HTTP codes and a troubleshooting page for each, though a quota breach comes back as a 400 ServiceQuotaExceededException beside the 429 ThrottlingException (18 of 20). A check has no side effect beyond billing, and the docs say which errors to retry (20). Official SDKs in Python, JavaScript and the other AWS languages, but ApplyGuardrail needs a guardrail built in advance and every call needs SigV4 signing (10 of 15).
- ShieldGemma (72): Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.

## Score by category

| Category | Weight | Amazon Bedrock Guardrails | ShieldGemma | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 75 | 46 | Amazon Bedrock Guardrails +29 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 92 | 56 | Amazon Bedrock Guardrails +36 |
| Agent ergonomics | 13% (16.2 this run) | 93 | 72 | Amazon Bedrock Guardrails +21 |
| Security & auth | 14% (17.5 this run) | 96 | 53 | Amazon Bedrock Guardrails +43 |
| Payments & pricing | 10% (12.5 this run) | 30 | 52 | ShieldGemma +22 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 65 | 40 | Amazon Bedrock Guardrails +25 |
| Transparency & trust | 7% (8.8 this run) | 70 | 54 | Amazon Bedrock Guardrails +16 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **77.4 · BB** | **54 · C** | |

## Facts side by side

| Fact | Amazon Bedrock Guardrails | ShieldGemma |
| --- | --- | --- |
| Kind | HTTP API | Model API |
| Vendor | Amazon Web Services | Google DeepMind |
| Hosted endpoint | `https://bedrock-runtime.{region}.amazonaws.com/guardrail/{id}/version/{version}/apply` | no (local only) |
| Transports | HTTP |  |
| Auth | API key | None |
| Pricing | Pay per use | Free |
| x402 | no | no |
| Licence | none | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-10-20 | 2025-04-04 |
| Terms last updated | 2026-10-01 | 2026-04-01 |
| Privacy policy last updated | 2026-05-18 | no document linked |
| Customer content may train models | yes, with an opt-out | yes |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | not found in the text |
| Popularity | 21.1M npm/wk | none |
| Agent reviews | 3.4/5 (8) | none |

## How the scores have moved

### Amazon Bedrock Guardrails

- +1.7 on 1 November 2026: product
- +0.1 on 27 October 2026: checklist
- +0.8 on 17 October 2026: security, new evidence, correction

### ShieldGemma

No score change since it was listed.

## Verdicts

**Amazon Bedrock Guardrails.** ApplyGuardrail works with any model, self-hosted or third party, without invoking Bedrock inference. Per-policy billing, so four paid policies on one request cost four times.

**ShieldGemma.** Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.

## Before you call either

### Amazon Bedrock Guardrails

1. Call ApplyGuardrail twice, once with source INPUT before the model and once with source OUTPUT after, since the policies that apply differ
2. Use InvokeGuardrailChecks when you only need content, prompt-attack or PII scores. It needs no guardrail id and runs in detect-only mode
3. Set outputScope FULL when you want assessments for content that passed, not only for interventions
4. Budget in text units of 1,000 characters per policy. A 5,000-character tool result is five units on every paid policy
5. Retry ThrottlingException (429) and ServiceUnavailableException (503) with exponential backoff, and plan for 100 ApplyGuardrail calls a second in main Regions, 25 elsewhere

### ShieldGemma

1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording
2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use
3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output
4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category
5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files

## Questions

### Which is better for AI agents, Amazon Bedrock Guardrails or ShieldGemma?

Amazon Bedrock Guardrails scores 77.4 (BB) on agent readiness against ShieldGemma's 54 (C), and leads in 6 of 7 scored categories. ShieldGemma leads on payments & pricing.

### Do Amazon Bedrock Guardrails and ShieldGemma need an API key?

Amazon Bedrock Guardrails needs an API key. ShieldGemma needs no key.

### Can an agent call Amazon Bedrock Guardrails and ShieldGemma without installing anything?

Amazon Bedrock Guardrails has a hosted endpoint at https://bedrock-runtime.{region}.amazonaws.com/guardrail/{id}/version/{version}/apply. No hosted endpoint is listed for ShieldGemma.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.json, and with the fewest tokens: https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "amazon-bedrock-guardrails", "b": "shieldgemma"}`. From a terminal: `anchor compare amazon-bedrock-guardrails shieldgemma`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/amazon-bedrock-guardrails.json and https://www.anchorterminal.com/api/v1/tools/shieldgemma.json

## Other comparisons with Amazon Bedrock Guardrails or ShieldGemma

- [Amazon Bedrock Guardrails vs Llama Guard 4](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-llama-guard.md)
- [Amazon Bedrock Guardrails vs Mistral Moderation API](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-mistral-moderation.md)
- [Amazon Bedrock Guardrails vs OpenAI Moderation API](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-openai-moderation.md)
- [Azure AI Content Safety (Prompt Shields) vs ShieldGemma](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.md)
- [Cisco AI Defense Inspection API vs ShieldGemma](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.md)
- [Google Cloud Model Armor vs ShieldGemma](https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.md)
- [Granite Guardian vs ShieldGemma](https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md)
- [Guardrails AI vs ShieldGemma](https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md)
- [Lakera Guard (Check Point AI Guardrails) vs ShieldGemma](https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.md)
- [Llama Guard 4 vs ShieldGemma](https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md)
- [Mistral Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.md)
- [NVIDIA NeMo Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.md)
- [OpenAI Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.md)
- [OpenAI Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.md)
- [Prisma AIRS AI Runtime Security API vs ShieldGemma](https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.md)
- [Amazon Bedrock Guardrails vs Azure AI Content Safety (Prompt Shields)](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-azure-ai-content-safety.md)
- [Amazon Bedrock Guardrails vs Cisco AI Defense Inspection API](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-cisco-ai-defense-inspection.md)
- [Amazon Bedrock Guardrails vs Google Cloud Model Armor](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-google-model-armor.md)
- [Amazon Bedrock Guardrails vs Granite Guardian](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-granite-guardian.md)
- [Amazon Bedrock Guardrails vs Guardrails AI](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-guardrails-ai.md)
- [Amazon Bedrock Guardrails vs Lakera Guard (Check Point AI Guardrails)](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-lakera-guard.md)
- [Amazon Bedrock Guardrails vs LlamaFirewall](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-llamafirewall.md)
- [Amazon Bedrock Guardrails vs NVIDIA NeMo Guardrails](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-nemo-guardrails.md)
- [Amazon Bedrock Guardrails vs OpenAI Guardrails](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-openai-guardrails.md)
- [Amazon Bedrock Guardrails vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-prisma-airs.md)
- [AgentGate vs Amazon Bedrock Guardrails](https://www.anchorterminal.com/compare/agentgate-vs-amazon-bedrock-guardrails.md)
- [AgentGate vs ShieldGemma](https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md)
- [LlamaFirewall vs ShieldGemma](https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.md)
- [Amazon Bedrock Guardrails vs Presidio](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-microsoft-presidio.md)
- [Presidio vs ShieldGemma](https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp