CedarDraft MCP

An MCP server that turns plain-language access rules for agent tool calls (English or Spanish) into Cedar policies, refuses any draft it cannot prove, and then gates each proposed tool call with ALLOW or DENY plus the ids of the policies that decided it.

The problem

Teams know an agent's tool calls should sit behind a policy: name the tools and arguments a task may use, and deny everything else. Writing Cedar by hand is slow. A policy nobody has checked can be worse than no policy, because it looks like protection. CedarDraft writes the draft, proves it against its own stated intent with the official Cedar tools, and enforces only proven drafts.

Related MCP server: ERDL Guard

Three tools

How a call maps to Cedar

The <server>___<tool> action name copies the <TargetName>___<ToolName> shape that the AgentCore Gateway docs give for MCP targets. That shape is the only AgentCore-related piece here.

Shared base schema with Cedar 4.14.0 external

schemas/base.cedarschema defines Role, Agent and Server once. Each draft's schema.fragment.cedarschema declares external entity Agent; and external entity Server; and only defines the actions for its catalog. The engine links them with Schema::schema_link_complete (cedar-policy 4.14.0). cedar validate refuses the fragment alone because it is a partial schema. Many drafts can share one base.

prove_policy stages

1. tools: cedar --version is exactly cedar-policy-cli 4.14.0, and the engine was built on cedar-policy 4.14.0.

2. intent: every rule names catalog servers, tools and arguments of the right type.

3. link: the fragment uses external, and linking it with the base leaves nothing external.

4. validate: strict validation in the crate against the linked schema, with zero errors and zero warnings.

5. cedar-cli: cedar validate --validation-mode strict --deny-warnings with the official CLI. The CLI has no schema-link command, so it gets a JSON merge of cedar translate-schema output.

6. ids: policy @ids equal the rule ids. Unexplained extra policies are rejected.

7. table: an authorization table built from the rule intent and the catalog, never from the policy text. Every catalog tool is called by an agent of each named role and of an outsider role, with neutral arguments and boundary values for each condition (N-1, N, N+1; each listed value plus one unlisted value). There must be at least one default-deny case, and every case must pass cedar run-tests.

8. crate-table: the same table through the crate, which is the gate_call path. Decisions and determining-policy sets must match exactly.

Quickstart

Requires Bun 1.4.3, Node 24 (.nvmrc) and Rust 1.99.0 (rust-toolchain.toml). No API keys.

bun install --frozen-lockfile
bun run setup        # cargo install cedar-policy-cli 4.14.0 --locked into .tools/, build engine/
bun run check        # full local gate

bun run cedardraft -- draft --file examples/rules.en-es.txt --out .cedardraft/example
bun run cedardraft -- prove .cedardraft/example                  # exit 0 accepted, 1 rejected
bun run cedardraft -- gate .cedardraft/example --agent a1 --role soporte \
  --server billing --tool refund --args '{"invoice_id":"i1","amount":50001,"currency":"USD"}'
# DENY - default deny: no permit policy matched                  (exit 2)

MCP client config (stdio):

{ "mcpServers": { "cedardraft": { "command": "bun", "args": ["run", "/path/to/cedardraft-mcp/src/mcp.ts"] } } }

The skill at .claude/skills/cedardraft-mcp/SKILL.md tells an agent how to use the three tools.

Rule patterns

The template drafter understands only these patterns. Any other sentence is an error that names the sentence. The drafter does not guess. Tools are written server.tool, or as any tool on server S / cualquier herramienta del servidor S. Roles are written agents with role R (or R2) / los agentes con rol R (o R2), or any agent / cualquier agente.

Numeric conditions: at most / no more than / up to (<=), under / less than / below (<), at least (>=), over / more than / greater than / above (>). Spanish: como máximo / a lo sumo / hasta, menor que / menos de, al menos / como mínimo, mayor que / más de. An optional argument is guarded with has, so a missing argument never satisfies a condition.

Measured

Produced by bun run report (reports/cedardraft.md, reports/cedardraft.json) on the committed fixtures on this machine. The CLI was cedar-policy-cli 4.14.0 and the engine was built on cedar-policy 4.14.0.

Verified facts (and where)

Limits

• Templates are narrow on purpose. There are six patterns, one condition per sentence, and one server per sentence. Anything else must be rephrased or drafted with Gemini.

• Gemini drafting is untested live. The key on this machine returns HTTP 402 (no credits), so no Gemini-written draft has been produced or measured. The Gemini path is covered by unit tests with synthetic, mocked responses. tests/live skips on a missing key, 402 or 429.

• The proof checks the policy text against the rule intent, not against what the user meant. If the intent itself is wrong (a wrong role or a too-high limit), the draft can prove. Review draft.json rules and their source sentences.

• The table is generated, not exhaustive. It probes boundaries and every catalog tool × role. It is not a symbolic proof. cedar symcc exists in the experimental CLI build and is not used here.

• The CLI does not link schemas. The cedar-cli stage validates a JSON merge that this repo computes. The link itself is checked by the crate (schema_link_complete). Both must pass.

• Cedar types: JSON number arguments (non-integer) cannot be typed in Cedar. They are left out of the context and listed as warnings, and no rule can reference them. Undeclared arguments make gate_call DENY.

• No AgentCore export. The idea's optional "AgentCore Policy export" is not built. The policies use the CedarDraft namespace, not AgentCore.

• Unverified idea context: the CERT-In guidance the idea quotes (define in-scope systems and actions per task) was not checked here. The scope pattern is only modeled on it. The Cedar docs site's schema grammar page does not yet mention external; the changelog and PR are the sources.

• Speed: gate_call starts one engine process per call (median 14.2 ms here). A long-lived engine would be faster but is not built.

Not affiliated

Not affiliated with, endorsed by, or sponsored by Amazon Web Services, the Cedar project, Google (Gemini), Anthropic or the Model Context Protocol project. Cedar and AgentCore are referenced only to describe compatibility facts checked above.

Built by SkilledDragon LLC. Questions: hello@skilleddragon.com. Educational minilab, not regularly maintained. See SECURITY.md.