MCP Zero Trust Layer

Website · PyPI · GHCR image · Documentation · Release 0.6.0

MCP Zero Trust Layer, usually shortened to MCPZT, is an open-source and self-hosted security layer for MCP servers. It sits between an MCP client and one or more real MCP servers, then decides what the client can discover, call, send, receive, approve and audit.

Developers and platform teams can enforce policies in front of existing MCP servers. Destination-signed receipts additionally require a cooperating destination; external checks require a scope-specific adapter, separate observer keys and explicit trust configuration.

MCP client / agent
  |
  v
MCP Zero Trust Layer
  |
  |  identity
  |  policy
  |  argument validators
  |  human approvals
  |  output enforcement
  |  audit
  v
real MCP server
  |
  v
database / repository / filesystem / CRM / payment API / internal system

This README is the public practical entry point: what the project does, how to run it, how to configure it, and how to reason about common policy patterns. It intentionally avoids linking to internal planning material so the published package stays focused on usage, operations and security.

The Short Version

An MCP server can expose very powerful capabilities. A read tool such as search_issues can expose sensitive data, while tools such as merge_pull_request, delete_repository, run_sql, send_email, read_secret or create_refund may have real operational impact. If a client can connect directly to the MCP server, the client may be able to list and call more tools than the user or organization intended.

MCPZT adds a policy layer in front of that server. It can hide capabilities from tools/list, block calls before they reach the upstream, validate arguments, require human approval for high-risk actions, redact sensitive output, and write audit logs explaining every important decision.

The important design point is that MCPZT is not a SaaS requirement. It runs locally, in Docker, in CI, as an internal gateway, as a sidecar, or as a stdio wrapper around command-based MCP servers. Configuration is plain YAML, so it can be reviewed in pull requests and versioned with the project it protects.

Status

Current release: 0.6.0, within the 0.x developer-preview line. Use mcpzt version to confirm your installed version. PyPI publishes the Python package; GHCR publishes :0.6.0, the moving :0.6 tag and :latest. Pin a release tag or image digest for repeatable deployments.