@cqnce/mcp-server
The @cqnce/mcp-server provides human-in-the-loop authorization for AI agents, enabling them to request, monitor, and manage approvals for risky actions like destructive, irreversible, or financial operations.
Core tools:
submit_authorization_request: Non-blocking submission, returns a request ID immediately.wait_for_approval: Blocks until a human decision (APPROVED/REJECTED), used for actions requiring immediate clearance.poll_request_status: Check the current status (PENDING, APPROVED, REJECTED, EXPIRED, CANCELLED) by ID.cancel_request: Cancel a pending request.list_requests: List and filter requests by status, date range, and tags for auditing.get_request: Retrieve full details including payload, metadata, and status.
Additional features:
Supports flexible approval workflows with routing modes (PARALLEL, SERIAL, MAJORITY, CHAIN) and custom routing rules.
Integrates with AI clients like Claude and Cursor, offering local execution or remote HTTP transport.
Enables project-level configuration, admin management of rules/agents/teams using an
CQNCE_ADMIN_TOKEN.Self-hostable via Cloudflare Worker for cloud-based agents.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@cqnce/mcp-serverRequest human approval before deploying the payments service to production"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@cqnce/mcp-server
Official MCP server for cQnce — add human-in-the-loop authorization to any AI agent or workflow.
Connect Claude, Cursor, GitHub Copilot, or any MCP-compatible client to cQnce so the AI can request human approval before performing risky or irreversible actions.
Quick start
npx @cqnce/mcp-serverSet the CQNCE_API_KEY environment variable to your project API key before running.
Related MCP server: Datashift MCP Server
Approval modes
Mode 1 — Agent-requested approval
The agent calls wait_for_approval or submit_authorization_request itself, as instructed in the system prompt or via tool discovery. This is the easiest integration path and works well for supervised workflows.
Risk: a compromised or misconfigured agent may simply not call the tool.
Mode 2 — Enforced approval gate (recommended for production)
The host application or executor intercepts every sensitive tool call before it runs and requires a prior cQnce approval, regardless of what the agent requested. The gate lives outside the model context — the agent cannot skip it.
This is a real security boundary. Build enterprise and compliance-sensitive integrations on this mode.
# Example: host-side interception (framework-agnostic)
HIGH_RISK_TOOLS = {"send_payment", "deploy_production", "delete_customer"}
def execute_tool_call(tool_call):
if tool_call.name not in HIGH_RISK_TOOLS:
return run_tool(tool_call)
decision = cqnce.submit_and_wait(
payload={"action": tool_call.name, "parameters": tool_call.arguments},
timeout_seconds=300,
)
if decision["status"] != "APPROVED":
return {"error": "not_authorized", "status": decision["status"]}
return run_tool(tool_call)Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"cqnce": {
"command": "npx",
"args": ["-y", "@cqnce/mcp-server"],
"env": {
"CQNCE_API_KEY": "your-project-api-key"
}
}
}
}Cursor
Add to .cursor/mcp.json in your project (or the global ~/.cursor/mcp.json):
{
"mcpServers": {
"cqnce": {
"command": "npx",
"args": ["-y", "@cqnce/mcp-server"],
"env": {
"CQNCE_API_KEY": "your-project-api-key"
}
}
}
}Any MCP client (stdio transport)
CQNCE_API_KEY=your-project-api-key npx @cqnce/mcp-serverCloud agents (Streamable HTTP / remote MCP)
For cloud-hosted agents that cannot run local processes, use the cQnce MCP Worker deployed on Cloudflare Workers. It speaks the MCP Streamable HTTP transport and is stateless — every request authenticates with your API key.
Configure your cloud agent framework to connect to:
https://mcp.cqnce.app/mcp
Authorization: Bearer <your-project-api-key>Example (Claude API with MCP):
import anthropic
client = anthropic.Anthropic()
response = client.beta.messages.create(
model="claude-opus-4-5",
max_tokens=1024,
mcp_servers=[
{
"type": "url",
"url": "https://mcp.cqnce.app/mcp",
"name": "cqnce",
"authorization_token": "your-project-api-key",
}
],
messages=[{"role": "user", "content": "..."}],
betas=["mcp-client-2025-04-04"],
)Self-hosting
The Worker source is in this repository. Deploy your own instance to Cloudflare Workers:
npm install
npx wrangler deploySet CQNCE_BASE_URL in the Cloudflare dashboard if you use a private cQnce deployment (defaults to https://api.cqnce.app).
Configuration
Variable | Required | Description |
| Yes | Project API key from cqnce.app |
| No | API base URL (default: |
| No | Tenant admin JWT — enables project/agent/team management tools |
Tools
Core (requires CQNCE_API_KEY)
Tool | Description |
| Submit a request and block until a human approves or rejects it. This is the primary tool for human-in-the-loop workflows. |
| Submit a request and return the |
| Check the current status of a request by ID. |
| Cancel a pending request. |
| List requests for this project (filterable by status, date, tags). |
| Get full details of a single request including agent responses. |
Admin (requires CQNCE_ADMIN_TOKEN)
Project management, routing rule configuration, agent/team management, and webhook callbacks.
Recommended system prompt
When integrating Claude via the Anthropic API, add this system prompt to enforce the authorization policy automatically — without relying on the user to request it each time:
You have access to the cQnce tool for human-in-the-loop authorization.
ALWAYS call wait_for_approval BEFORE performing any action that is:
- Destructive or irreversible (deleting data, dropping tables, removing files)
- Affecting production systems (deployments, database migrations, config changes)
- Financial (payments, transfers, subscription changes)
- Involving credentials or access control (creating/revoking API keys, changing permissions)
In the approval payload, include:
- "action": what you are about to do
- "target": what resource is affected
- "reason": why this action is needed
- "risk": what happens if approved or rejected
- "attachments": (optional) list of supporting files as { name, contentType, data (base64) }
— include logs, diffs, screenshots, or any evidence that helps the reviewer decide
When the response status is "REJECTED":
- Read the rejection reason carefully.
- If the reason identifies missing information or context, gather that information,
enrich the payload (or attachments), and resubmit via wait_for_approval.
- Only give up if the rejection reason makes clear the action itself is not permitted.
Proceed ONLY if the returned status is "APPROVED".
If "EXPIRED" or the rejection reason leaves no actionable path forward, stop and explain.Example
Once configured, you can tell Claude:
"Before deleting the production database, ask for human approval via cQnce."
Claude will call wait_for_approval with the action details, pause until a human approves or rejects from the cQnce mobile app, and only proceed if the status is APPROVED. If rejected with a reason (e.g. "missing rollback plan"), Claude will gather that information and resubmit automatically.
Requirements
Node.js 18+
A cQnce account and project API key — sign up free
Available Tools
6 toolscancel_requestA
Cancel a pending cQnce authorization request. Use this if the action is no longer needed and you want to release the human agents.
| Name | Required | Description | Default |
|---|---|---|---|
| requestId | Yes | The request ID to cancel. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of transparency. It only notes the operation works on pending requests and 'releases human agents,' but does not disclose whether the cancellation is reversible, what state changes occur, or if errors arise for non-pending requests. This is insufficient for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, two sentences, and front-loaded with purpose. However, the typo 'cQnce' is a minor distraction and reduces polish.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter tool, the description is adequate but not complete. It lacks details on response behavior, edge cases, or potential failures, which an agent would need for reliable invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully documents the only parameter (requestId) with a description. The tool description adds no parameter information, but since schema coverage is 100%, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool cancels a pending authorization request, using a specific verb and resource. It is distinguishable from siblings like submit_authorization_request and poll_request_status, which have different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage context: 'Use this if the action is no longer needed and you want to release the human agents.' This tells the agent when to invoke the tool, though it lacks explicit exclusions or alternative comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_requestA
Get full details of a single authorization request, including payload, metadata, agent responses, and current status.
| Name | Required | Description | Default |
|---|---|---|---|
| requestId | Yes | The request ID to retrieve. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It describes the return payload but does not explicitly confirm read-only behavior, error handling, or permissions. The verb 'Get' implies a safe read, but this is not spelled out.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the purpose and includes useful detail about what is returned. Every word adds value with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with one parameter and no output schema, the description adequately explains the return content. It lacks explicit alternatives, but the level of detail is sufficient for an agent to understand the tool's role.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter requestId is fully described in the schema (100% coverage), so the description adds no additional parameter semantics. The baseline is 3 because the schema already carries the meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb and resource: 'Get full details of a single authorization request.' It enumerates the content (payload, metadata, agent responses, current status) and distinguishes itself from siblings like poll_request_status (which likely only returns status) and list_requests (which lists multiple).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when full details of a single request are needed, but it does not explicitly contrast with alternatives or provide when-not-to-use guidance. Sibling names are known, but the description itself lacks explicit usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_requestsA
List authorization requests for this project. Useful for monitoring ongoing requests, debugging workflows, and auditing decisions.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Filter by one or more tags. | |
| limit | No | Maximum number of results to return (default: 50). | |
| offset | No | Pagination offset (default: 0). | |
| status | No | Filter by request status. | |
| endDate | No | ISO 8601 end date filter (e.g. 2024-12-31). | |
| projectId | No | Filter by project ID (admin token required when used). | |
| startDate | No | ISO 8601 start date filter (e.g. 2024-01-01). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. 'List' implies a read-only operation, but the description does not explicitly state that it is non-mutating, nor does it mention pagination behavior or default limits. It adds minimal behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long and front-loaded with the primary action ('List authorization requests'), followed by concise use cases. Every word earns its place; there is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's purpose and typical use cases, which is adequate for a list operation. However, with 7 parameters and no output schema, it does not mention that results can be filtered or paginated, nor the shape of the return value. The schema compensates for filter details, but the description could be slightly richer about the response structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description does not mention any parameters or add meaning beyond what the schema already provides for tags, status, date filters, or pagination. It neither clarifies nor repeats parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'List authorization requests for this project,' which is a specific verb (list), resource (authorization requests), and scope (this project). This clearly distinguishes it from siblings like get_request (single request) and cancel_request (mutation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: 'Useful for monitoring ongoing requests, debugging workflows, and auditing decisions.' However, it does not explicitly exclude alternatives like get_request for individual requests or poll_request_status for status checks, so it lacks explicit when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
poll_request_statusA
Check the current status of a cQnce authorization request. Terminal statuses are: APPROVED, REJECTED, EXPIRED, CANCELLED. PENDING means the request is still waiting for a human decision. For a blocking wait, use wait_for_approval instead.
| Name | Required | Description | Default |
|---|---|---|---|
| requestId | Yes | The request ID returned by submit_authorization_request. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral disclosure burden. It explains the meaning of terminal statuses (APPROVED, REJECTED, EXPIRED, CANCELLED) and PENDING, and clarifies that this is a non-blocking operation by directing blocking waits elsewhere. While it doesn't cover error behavior or rate limits, the key behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, with the core action front-loaded in the first sentence, followed by status definitions and an alternative tool reference. Every sentence contributes value and there is no waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read-only tool, the description is largely complete. It covers the statuses and the alternative, and the lack of an output schema is partially compensated by listing expected status values. It could explicitly state the return format or error handling, but this is a minor gap for such a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers the single parameter fully with a description for requestId, so the schema carries the parameter semantics. The tool description does not add extra detail about the parameter, but the baseline is 3 given 100% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Check' and identifies the resource as the status of a cQnce authorization request. It also lists terminal statuses, making the tool's function unmistakable. The explicit mention of wait_for_approval as an alternative further clarifies its distinct role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool versus wait_for_approval, saying 'For a blocking wait, use wait_for_approval instead.' This provides clear guidance for the primary alternative. It does not mention other siblings like get_request, but the core usage distinction is well covered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_authorization_requestA
Submit a human authorization request to cQnce. Use this BEFORE performing any risky, destructive, or irreversible action (e.g. deploying to production, executing a database migration, making a payment, modifying credentials). Returns a requestId that you can pass to wait_for_approval or poll_request_status.
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | Structured description of the action requiring authorization. Include all context a human needs to approve or reject (e.g. action, target, amount, reason). | |
| metadata | No | Optional additional context (correlation IDs, tags, environment, etc.). | |
| wsClientId | No | WebSocket client ID for real-time status delivery. | |
| callbackUrl | No | Webhook URL to notify when the request is resolved. | |
| routingMode | No | Override the routing mode configured on the matching rule. | |
| routingRuleId | No | Directly select a routing rule by ID, bypassing filter evaluation. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses the key behavior (returns requestId) and its intended pre-action role. However, it doesn't mention error scenarios, idempotency, or side effects like human notifications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the primary verb and resource, then concise usage and next-step guidance. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, but description explains the key return (requestId) and how to use it with sibling tools. Covers the tool's workflow well, though it could mention response details or failure modes for fuller completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters. Description adds no parameter-level detail beyond schema, which is acceptable given the high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States 'Submit a human authorization request' – specific verb+resource. Distinguishes from siblings by noting it's for risky/destructive actions and returns a requestId used with wait_for_approval or poll_request_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this BEFORE performing any risky, destructive, or irreversible action' with concrete examples. Mentions follow-up tools (wait_for_approval, poll_request_status) but does not explicitly contrast with other siblings like get_request or cancel_request.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wait_for_approvalA
Submit an authorization request and BLOCK until a human approves or rejects it (or until the timeout elapses). This is the primary tool for human-in-the-loop workflows: call it, wait for the result, and proceed ONLY if status is APPROVED. If status is REJECTED or EXPIRED, do NOT proceed with the action.
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | Structured description of the action requiring authorization. Include all context a human needs to approve or reject. | |
| metadata | No | Optional additional context (correlation IDs, tags, environment, etc.). | |
| timeoutMs | No | Maximum milliseconds to wait for a human decision before giving up (default: 300000 = 5 min). | |
| callbackUrl | No | Webhook URL to notify when the request is resolved. | |
| routingMode | No | Override the routing mode configured on the matching rule. | |
| routingRuleId | No | Directly select a routing rule by ID, bypassing filter evaluation. | |
| pollIntervalMs | No | How often to poll for a status update in milliseconds (default: 3000). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does well: it discloses blocking behavior, timeout behavior, and possible statuses (APPROVED, REJECTED, EXPIRED). It does not mention error handling or return format, but the core behavioral traits are clearly communicated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the critical blocking behavior, and zero filler. Every clause adds value, and the instruction about not proceeding on non-approval is clear and action-oriented.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description should explain what the result contains. It names the statuses but not the overall response structure (e.g., whether it's an object with a status field). For a blocking HITL tool, this is a moderate gap; the complexity of routing options is left entirely to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already describes all 7 parameters. The description adds no additional parameter-specific meaning beyond implying the tool blocks and returns a status. Baseline 3 is appropriate; it neither degrades nor enhances schema understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Submit an authorization request and BLOCK until a human approves or rejects it (or until the timeout elapses).' It uses specific verbs (submit, block) and identifies the resource (authorization request), distinguishing it from siblings like submit_authorization_request which likely does not block.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly positions this as 'the primary tool for human-in-the-loop workflows' and provides clear post-conditions: 'proceed ONLY if status is APPROVED' and 'do NOT proceed' on REJECTED or EXPIRED. It lacks explicit alternatives/exclusions, but the guidance on when to use it is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.1- First observed
cancel_request - First observed
get_request - First observed
list_requests - First observed
poll_request_status - First observed
submit_authorization_request - First observed
wait_for_approval
TDQS
Scored across 6 tools
The tools are mostly distinct, but submit_authorization_request and wait_for_approval overlap in that wait_for_approval also submits. The descriptions clarify the difference (blocking vs non-blocking), so an agent can distinguish them with careful reading. All other tools have clear boundaries.
Tool names follow a verb_noun pattern with verbs like submit, poll, wait, cancel, list, get. However, the noun varies (authorization_request, request_status, approval, request, requests), so it is not perfectly uniform. The pattern is still predictable and easy to learn.
Six tools cover the full authorization request workflow without redundancy or bloat. Each tool serves a distinct step in the lifecycle, making the count well-scoped for the server's purpose.
The tool set provides complete coverage of the authorization request domain: submit, wait/poll for status, cancel, list, and get details. There are no obvious missing operations for an agent-driven human approval workflow.
Maintenance
Related MCP Connectors
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Human-in-the-loop review and approval for AI agents. Audit trail, approval policies, native MCP.
Human-in-the-loop for AI agents over MCP: durable approvals with a hosted review page & audit trail
Find, vet, and run MCP tools through a secure audited gateway with prompt-injection risk scoring
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceHuman-in-the-Loop authorization gateway for AI Agents. Securely pause MCP workflows and route high-risk actions to human approvers via Slack or Email.40 npm1MIT

Datashift MCP Serverofficial
AlicenseNot gradedqualityDmaintenanceEnables AI agents to submit tasks for human or AI review and receive decisions via MCP tools, adding human review checkpoints to workflows.MIT
Oakallow MCP Serverofficial
AlicenseNot gradedqualityDmaintenanceRuntime permission, approval, and audit governance for AI agent tool execution, enabling human oversight of risky actions via an MCP server.1MIT- FlicenseNot gradedqualityBmaintenanceProvides a secure MCP boundary for AI agents, intercepting and validating tool calls, redacting secrets, and requiring human approval for sensitive actions with a tamper-evident audit trail.-