tomjwxf/scopeblind-gateway

>
> This personal fork may be behind the canonical repository. Please use the org repo for issues, pull requests, and the latest code.
protect-mcp
Security gateway for MCP servers. Shadow-mode logs by default, per-tool policies, optional local Ed25519 receipts, and verification-friendly audit output.
**Current CLI path:** wrap any stdio MCP server as a transparent proxy. In shadow mode it logs every tools/call request and allows everything through. Add a policy file to enforce per-tool rules. Run protect-mcp init to generate local signing keys and config so the gateway can also emit signed receipts.
Quick Start
What It Does
protect-mcp sits between your MCP client and server as a stdio proxy:
It intercepts tools/call JSON-RPC requests and:
- **Shadow mode** (default): logs every tool call and allows everything through
- **Enforce mode**: applies per-tool policy rules such as block, rate_limit, and min_tier
- **Optional local signing**: when signing is configured, emits an Ed25519-signed receipt alongside the structured log
All other MCP messages (initialize, tools/list, notifications) pass through transparently.
What Ships Today
- **Per-tool policies** — block destructive tools, rate-limit expensive ones, and attach minimum-tier requirements
- **Structured decision logs** — every decision is emitted to stderr with [PROTECT_MCP]
- **Optional local signed receipts** — generated when you run with a policy containing signing.key_path, persisted to .protect-mcp-receipts.jsonl, and exposed at http://127.0.0.1:9876/receipts
- **Offline verification** — verify receipts or bundles with npx @veritasacta/verify
- **No account required** — local keys, local policy, local process
Current Capability Boundaries
These are important before you roll this out or talk to users:
- **Signing is not automatic on the bare npx protect-mcp -- ... path.** That path logs decisions in shadow mode. For local signing, run npx protect-mcp init and then start the gateway with the generated policy file.
- **Tier-aware policy checks are live, but manifest admission is not wired into the default CLI/stdio path.** The CLI defaults sessions to unknown unless a host integration calls the admission API programmatically.
- **Credential config currently validates env-backed credential references and records credential labels in logs/receipts.** Generic per-call injection into arbitrary stdio tools is adapter-specific and is not performed by the default proxy path.
- **External PDP adapters and audit bundle helpers exist as exported utilities.** They are not yet fully wired into the default CLI path.
Policy File
Policy Rules
| Field | Values | Description |
|-------|--------|-------------|
| block | true | Explicitly block this tool |
| require | "any", "none" | Basic access requirement |
| min_tier | "unknown", "signed-known", "evidenced", "privileged" | Minimum tier required if your host sets admission state |
| rate_limit | "N/unit" | Rate limit (e.g. "5/hour", "100/day") |
Tool names match exactly, with "*" as a wildcard fallback.
MCP Client Configuration
Claude Desktop
Add to claude_desktop_config.json: