# razorpay-mcp-guard

**Spend-policy enforcement middleware for Razorpay's MCP server.**

Razorpay's official MCP server executes what it's told. Nothing in the stack vets
*what an agent is allowed* to tell it. `razorpay-mcp-guard` is an MCP middleware
that sits between the LLM agent and the Razorpay MCP tools, enforcing:

- **Per-agent spend caps** — daily / monthly / lifetime limits, enforced in paise.
- **Category allowlists** — only whitelisted tool categories (e.g. `payments`,
  `settlements`) are reachable; everything else is blocked at the gate.
- **Approval thresholds** — calls above a configurable rupee amount require
  explicit human approval before they reach Razorpay.

Every decision (allow, block, escalate) lands in an **append-only audit ledger**
with hash-chained entries, so the trail itself is tamper-evident.

```
┌─────────────┐     tools/call      ┌──────────────────┐    policy: ALLOW   ┌──────────────────┐
│  LLM Agent  │ ──────────────────► │  mcp-guard       │ ─────────────────► │  Razorpay MCP    │
│ (any client)│ ◄────────────────── │  (this proxy)    │ ◄───────────────── │  server          │
└─────────────┘     result          └──────────────────┘    result          └──────────────────┘
                                        │      ▲
                            BLOCK/ESCALATE   approve/deny
                                        ▼      │
                                   Policy Engine + Audit Ledger + Approval Gate
```

## Status

Work in progress — see [docs/architecture.md](docs/architecture.md).

## License

MIT