sp3ak/safenode-mcp-gateway

An MCP proxy that enforces policy on every tool call. The agent cannot route around it.
Why a proxy
An MCP server that exposes an evaluate_action tool is theatre. The model can choose not to call
it, which means it enforces nothing.
This is a **proxy**. It sits between your MCP client (Claude Desktop, Claude Code, Cursor, any MCP
host) and the MCP servers you already use. tools/list passes straight through, so the model sees
exactly the tools it saw before. Every tools/call is evaluated against SafeNode *first*. A denial
means the call never reaches the downstream server at all.
Your agent needs no code changes. It does not know the gateway is there.
Get an API key — free tier, no card ·
Docs ·
Python SDK
---
Setup
1. Get an API key
Free at safenode.tech. Keys look like sn_....
2. Write a config
safenode-gateway.json — take the servers straight out of your existing MCP client config:
Do **not** put your API key in this file. Set SAFENODE_API_KEY in the environment — it takes
precedence over the config, so the file stays safe to commit.
3. See what would be sent, before sending anything
Prints the exact JSON body that an evaluation would POST. No network call. This is the fastest way
to satisfy yourself about what leaves your machine.
4. Point your MCP client at the gateway
**Claude Desktop** — claude_desktop_config.json:
**Claude Code** — .mcp.json in your project:
**Cursor** — ~/.cursor/mcp.json, same shape as Claude Desktop.
Replace your existing server entries with this one. The gateway spawns them itself, so listing them
in both places would run each server twice.
---
What each decision does
| Decision | Behaviour |
| --- | --- |
| allow | Forwarded. The downstream result is returned unchanged. |
| warn | Forwarded, with a [SafeNode warning] line prepended so the model *and* the human see it. |
| review | **Not forwarded.** Returns a message saying approval is needed. |
| deny | **Not forwarded.** Returns the human-readable reasons and the trace_id. |
Denials come back as MCP tool *errors*, not transport failures, so the model sees why and can try
something else instead of the host surfacing an opaque crash.
Fail behaviour
failMode decides what happens when SafeNode itself is unreachable.
| | |
| --- | --- |
| fail_closed **(default)** | Block the call. |
| fail_open | Forward it, unevaluated. |
| raise | Crash the gateway. |
**The gateway defaults to fail_closed, unlike the SafeNode SDKs, which default to fail_open.**
That difference is deliberate. An SDK wraps a developer's own code, where taking production down
during a SafeNode outage loses the user forever. The gateway fronts arbitrary MCP tools it knows
nothing about — filesystem writes, shell commands, payments — and silently letting all of that
through the moment SafeNode is unreachable defeats the point of installing it.
Loosen it per tool for the read-only ones:
Degraded decisions are logged to stderr and marked "degraded": true with a null traceId in the
decision log, so they can never be counted as real policy decisions.
What data leaves your machine
For every tool call, the gateway sends: the tool name, the downstream server name, a session id,
any static context from your config, and the **tool arguments** as the payload.
payloadMode controls the arguments:
| | |
| --- | --- |
| full | Sent verbatim. |
| redacted **(default)** | Scrubbed client-side first. |
| metadata_only | No values at all — key names and hashes only. |
Redaction covers emails, Luhn-validated credit cards, US SSNs, provider API key prefixes (sk-,