An **agentgateway ExtMcp guardrail sidecar** that wraps an ONNX-based PromptGuard-2 scanner (prompt-injection detection via the public, non-gated Guardrails-style rule engine (cross-call toxic-flow / loop detection) behind the agentgateway ExtMcp gRPC contract. The sidecar is **fail-closed by default**, listens on plaintext HTTP/2 (`h2c`) gRPC on `:9001`, and is driven