Security gateway for MCP servers. Shadow-mode logs, per-tool policies, approval gates, optional Ed25519-signed receipts.
What's new in v0.3.1
- Per-tool policies: block, rate-limit, require approval, minimum trust tier
- Approval flow with request_id scoping and nonce authentication
- Passport identity in protect-mcp status
- Signed decision receipts persisted to disk
- Audit bundle export
- Policy packs: shadow, web-browsing-safe, email-safe, strict
Quick start
npx protect-mcp -- node your-server.js
Verify receipts independently
npx @veritasacta/verify --self-test
npm: https://www.npmjs.com/package/protect-mcp
Docs: https://scopeblind.com/docs/mcp