protect-mcp

MCP serverAI & models

This adds a policy gate in front of your AI's tool calls: every call is checked against Cedar policy rules, and only calls the rules allow go through. If a check errors for any reason, the call is denied instead of being allowed. Each decision is recorded as an Ed25519-signed receipt you can keep as verifiable proof of what happened.

Unavailable. This server has no hosted endpoint yet, so Ahel can't serve it.

Add to setup to save this item as a reference. Ahel cannot run it, and signing in will not install it.

What your AI can do with it

  • Check every agent tool call against your Cedar policy rules before it runs
  • Deny a tool call when the policy check errors, instead of letting it through
  • Produce an Ed25519-signed receipt for each tool call decision
  • Give you verifiable records you can use to review what your AI was allowed to do

Getting started

  1. Save this item in Your setup as a reference.
  2. Read the source or reference documentation for its setup requirements. Saving it here does not connect it to your AI.
  3. Check this page for availability before trying to install it through Ahel.

From the project's README

As published by scopeblind/scopeblind-gateway in README.md. This repository publishes several servers, so only the opening is shown here.

Fail-closed Cedar policy gate plus signed receipts for AI agent tool calls.

protect-mcp is a gate that sits in front of an AI agent's tool calls. It evaluates each call against a Cedar policy (the same language AWS uses for IAM), blocks what breaks the rules before it runs, and signs an offline-verifiable Ed25519 receipt of every decision. It runs locally, sends no telemetry of your decisions anywhere, and is MIT licensed.

Why it is different

Shortened here. Read the whole README on GitHub.

Signals

GitHub stars
9
Forks
4
Last commit
Oct 2026
Weekly downloads
789
Weekly_downloads
789 weekly_downloads
Advanced
Delivery
protect-mcp MCP server → your Ahel connector (mcp.ahel.ai) → your AI.
Item type
mcp-server
Key
com-scopeblind-protect-mcp
Source
github.com/scopeblind/scopeblind-gateway