permission-protocol/mcp-guard
Developer toolsЭта страница переведена автоматически. Технические детали смотрите в оригинале. Открыть оригинал
MCP middleware that blocks dangerous AI agent actions using a simple YAML config
Обзор
MCP (Model Context Protocol) is how AI agents call tools — like APIs, databases, or deployments. MCP has no built-in access control. MCP Guard adds that layer. Define what's allowed, blocked, or requires approval — in a single YAML file. MCP Guard sits between your MCP client and server, enforces the rules, and logs every decision as an audit receipt. Without MCP Guard, your agent can call any tool. With it, every action is checked. → unsafe tool calls before they execute → sensitive actions for human approval → every decision as an immutable receipt → — audit what would be blocked before enforcing That's it. Your agent can no longer delete user data. Production deploys require approval. Everything is logged to pp-receipts.jsonl, and each decision gets a shareable receipt URL. See MCP Guard block dangerous tool calls in real-time, no setup required: MCP Guard intercepts JSON-RPC messages on stdin/stdout. When it sees a tools/call request: 1.
README
Показан фрагмент оригинального README. Открыть оригинал.
MCP Guard
Stop your AI agents from doing dangerous things.
MCP (Model Context Protocol) is how AI agents call tools — like APIs, databases, or deployments. MCP has no built-in access control. MCP Guard adds that layer.
Define what’s allowed, blocked, or requires approval — in a single YAML file. MCP Guard sits between your MCP client and server, enforces the rules, and records every decision as a signed receipt.
Every tool call, resource read and prompt fetch goes through your policy; only protocol plumbing (initialize, ping, list calls, notifications) passes untouched. MCP Guard does not just log — it blocks execution before it happens.
→ Blocks unsafe tool calls before they execute → Holds sensitive actions for human approval → Signs every decision as an Ed25519 receipt in the Permission Protocol receipt standard, naming who or what decided → Observe mode — audit what would be blocked before enforcing
Get Started (2 minutes)
# Install
npm install @permission-protocol/mcp-guard
# Create your signing key (once; the guard never creates one itself)
npx mcp-guard keys init
# Create a policy file
cat > pp.config.yaml << 'EOF'
default_action: allow
rules:
- id: block-delete
tool: delete_user_data
action: block
- id: hold-deploy
tool: deploy_production
action: require_approval
EOF
# Run your MCP server through the guard
mcp-guard --config pp.config.yaml -- node my-mcp-server.js
That’s it. Your agent can no longer delete user data. Production deploys require approval. Every decision is signed and logged to pp-receipts.jsonl. Without a signing key the guard refuses to start (SIGNING_KEY_MISSING) rather than run unsigned.
default_action: allow lets any tool without a rule run, and the guard warns about it at startup. Use block or require_approval to fail closed.
60-Second Demo (no MCP server needed)
See MCP Guard block dangerous tool calls in real-time, no setup required:
npx @permission-protocol/mcp-guard demo
The demo signs with a throwaway demo key (mcpg-demo-…) in a temporary directory. Its receipts carry scope: "demo", and gates refuse them.
Architecture
┌────────────┐ stdio ┌─────────────┐ stdio ┌────────────┐
│ MCP Client│ ──────────────▶│ MCP Guard │──────────────▶ │ MCP Server │
│ (Claude, │ │ (proxy) │ │ (your app) │
│ Cursor) │ ◀──────────────│ │◀────────────── │ │
└────────────┘ responses └─────────────┘ responses └────────────┘
│
▼
pp-receipts.jsonl
(audit trail)
MCP Guard parses every JSON-RPC message on stdin and forwards only what it parsed and evaluated, re-serialized:
Установка
npx mcp-guard keys initКонфигурация
{
"mcpServers": {
"my-server": {
"command": "node",
"args": ["my-mcp-server.js"]
}
}
}