aggrete/aggrete

**An MCP proxy that enforces a code-of-conduct document across connectors, with per-user memory that accumulates across calls.**
Four individually-authorized questions can assemble a layoff list — no single one is sensitive, so no guardrail fires. Aggrete is the layer that catches the *combination*: is this call, together with everything this person already pulled today, something the code of conduct forbids?
**Try it live** — nothing to install · or uvx aggrete --demo
Start with a scan
Finds every MCP server your clients use, connects to each, and prints what no per-server scanner does: tool combinations across servers that form a leak path, hidden instructions in descriptions, secrets in client configs, servers that bypass the proxy. --fix writes the config and policy that close them. Details.
Install
The one example
The check tool dry-runs a plan and returns the verdict **before anything is fetched**:
Each call is fine alone. The third completes a forbidden set across three domains that overlap on the same people, so it's denied **before the upstream call** — the data is never fetched.
What it does
- **Refuses before fetching**, using a YAML policy and per-user memory across calls and sessions — not single-call authorization.
- **Redacts** emails, SSNs, cards, and tokens from results before they reach the model; **hides** walled tools from users who can't call them.
- **Shields against prompt injection** — any write after a session reads untrusted content is refused — and against **tool poisoning**, flagging hidden instructions in tool descriptions.
- **Holds upstream credentials itself** (confused-deputy safe), with optional per-user on-behalf-of access.
- **Audits tamper-evidently** — every decision is one hash-chained JSON line (aggrete-audit), forwarded to a SIEM or an OpenTelemetry collector, with Prometheus metrics and health endpoints for operations.
- **Ask before you act** — check previews any sequence, scenarios lists things to try.
- **Hold for a human** — action: approve pauses a call until the clause owner approves it, from Slack, the terminal, or the console; the approval is a time-limited, audited grant.
Learn more
- **Writing policy** — the coc.yaml schema, rule types, arg_match, and drafting from your handbook with aggrete-ingest
- **Deploying** — architecture, the deploy matrix, HTTP + OAuth, connecting Claude, and per-user credentials
- **Building a connector** — expose read/write tools and govern any system (Google Drive is the reference)
- **Adapter mode** — run the engine inside agentgateway (native ExtMCP over gRPC, aggrete extmcp), Docker MCP Gateway, IBM ContextForge or any AuthZEN-speaking gateway
- **What it does not stop** — supply chain, host execution, client bugs, memory poisoning: where a proxy is the wrong control and what is
- **Scanning** — aggrete scan hardens an existing MCP setup: cross-server leak paths, poisoned descriptions, secrets in configs, proxy bypasses, and a one-command fix