Skip to main content
Glama
mcp-policy-gateway

mcp-policy-gateway

by jcorrego

mcp-policy-gateway

Una implementación de referencia de servidor MCP con políticas primero. Muestra cómo darle al agente herramientas útiles sin permitir que el modelo decida la autorización, cruce límites de tenant, filtre PII directa o ejecute mutaciones de alto impacto por su cuenta.

Esto es una implementación de portafolio/referencia. Cada registro es sintético; no es software de producción y no pretende integrarse con un banco, procesador de pagos o sistema de clientes.

Por qué existe esto

Una demo común de MCP expone una API cruda al modelo y trata una llamada de herramienta exitosa como un modelo de seguridad. Este proyecto adopta la posición opuesta:

  • La política es determinista. El modelo no puede autorizarse a sí mismo.

  • El límite de tenant se aplica en el servidor. Un argumento de herramienta no puede cambiar de tenant.

  • La salida de la herramienta se minimiza. El resumen de cuenta excluye intencionalmente el nombre del propietario y el correo electrónico.

  • Las acciones de alto impacto se detienen en una puerta de aprobación. Una solicitud de congelación no produce ningún cambio de estado.

  • Cada decisión es auditable. Los resultados de permitir, denegar y requerir aprobación crean eventos de auditoría estructurados.

  • Las solicitudes de mutación requieren una razón y una clave de idempotencia.

Related MCP server: Aegis

Arquitectura

MCP client / agent
       │ tool call
       ▼
FastMCP stdio adapter
       │ verified principal (demo fixture here)
       ▼
GatewayService ──► PolicyEngine ──► allow / deny / require approval
       │                 │
       ▼                 ▼
synthetic domain data   structured audit event

En un despliegue de producción, el principal se derivaría de una identidad/sesión verificada fuera del contexto del modelo. Nunca aceptes tenant_id, roles o ámbitos de un argumento de herramienta o salida del modelo.

Herramientas

Herramienta

Riesgo

Comportamiento

get_case(case_id)

Lectura

Permite solo casos en el tenant del llamador con el ámbito correcto.

get_account_summary(account_id)

Lectura

Devuelve un resumen minimizado; nunca PII directa.

request_account_freeze(...)

Mutación

Requiere un ámbito, razón y clave de idempotencia, y luego siempre requiere aprobación humana.

Inicio rápido

Requiere Python 3.11+.

python -m venv .venv
.venv/bin/pip install -e '.[dev]'
.venv/bin/pytest
.venv/bin/ruff check .

Ejecutar como servidor MCP stdio:

.venv/bin/mcp-policy-gateway

El adaptador usa un principal de demostración deliberadamente fijo para exploración local. La propagación real de identidad se documenta intencionalmente como una preocupación de integración de producción en lugar de simularse aquí.

Controles de abuso demostrados

Las pruebas demuestran que la puerta de enlace:

  1. deniega a un agente de tenant_red que intenta leer datos de tenant_blue;

  2. deniega una llamada de herramienta sin su ámbito requerido;

  3. no devuelve el nombre del propietario ni el correo electrónico a través de la herramienta de resumen;

  4. devuelve require_approval en lugar de mutar el estado de la cuenta; y

  5. rechaza solicitudes de cambio de estado que omiten una razón o clave de idempotencia.

Modelo de amenazas y no objetivos

Ver THREAT_MODEL.md. El diseño es intencionalmente limitado: demuestra un límite de política alrededor de las herramientas MCP, no infraestructura de identidad completa, almacenamiento de auditoría duradero, gestión de secretos o un sistema de pagos/contabilidad.

Recorrido para entrevistas

Una forma concisa de explicar el proyecto:

Diseñé el límite MCP para que el modelo pueda razonar sobre datos seguros y con ámbito, pero no pueda decidir el acceso ni ejecutar acciones de alto impacto. La autorización es determinista, el aislamiento de tenant se aplica en el servidor, la superficie de herramientas minimiza la PII y las mutaciones sensibles terminan en una puerta de aprobación humana auditable.

Desarrollo

.venv/bin/pytest
.venv/bin/ruff check .

CI ejecuta ambas comprobaciones en pushes y pull requests.

Licencia

MIT. Ver LICENSE.

Available Tools

3 tools
get_account_summaryB

Return a minimized account summary; this tool never exposes direct PII.

NameRequiredDescriptionDefault
account_idYes

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full burden. It discloses a key behavioral trait: 'this tool never exposes direct PII', which is valuable privacy context. However, it does not mention other behaviors such as whether it requires specific permissions, handles missing accounts, or returns errors. The single disclosed trait is important but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the primary action and object, then adds a meaningful privacy qualifier. It is appropriately short and contains no filler, though it could include a bit more context without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one parameter and no output schema, so the description need not be extensive. Still, it leaves gaps: no mention of what the summary contains, how to interpret the response, or typical usage scenarios. While not critical for a trivial read operation, the lack of any usage guidance and return format means an agent may not fully understand the tool's output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameter descriptions (coverage 0%), and the description does not mention the 'account_id' parameter at all. The parameter name is self-explanatory, which partially compensates, but the description adds no semantic detail about its format, scope, or expected values. Since schema coverage is low, the description should have compensated but did not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Return') and the resource ('account summary'), and adds the qualifier 'minimized' to distinguish it from a full account detail. While it does not explicitly name sibling tools, the siblings (get_case, request_account_freeze) are sufficiently different in name and purpose that an agent can distinguish without explicit differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool vs alternatives, nor any exclusions or prerequisites. It only says it returns a summary, implying it is for summary needs, but does not mention when to prefer it over get_case or request_account_freeze, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_caseA

Retrieve a support case inside the caller's tenant boundary.

NameRequiredDescriptionDefault
case_idYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the full behavioral burden. It does disclose a meaningful constraint—the tenant-boundary scoping and read-only retrieval semantics of 'Retrieve.' However, it does not disclose error behavior for missing/non-accessible cases, auth requirements, or return expectations, which are meaningful gaps for an unannotated tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with the verb and resource front-loaded and zero filler. The tenant-boundary qualifier earns its place as a scope constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple retrieve-by-ID tool with a single parameter and no output schema, the description covers the essentials: what it retrieves and under what scope boundary. Missing output-format and error details are minor for this complexity tier.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description should compensate. It connects case_id to 'support case' and the tenant-boundary constraint, adding some meaning beyond the bare name. Still, it provides no format, example, or uniqueness detail for case_id—though the single self-explanatory parameter name reduces the need for heavy elaboration.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

'Retrieve a support case' states a specific verb and resource, and the tenant-boundary clause adds a precise scope constraint. The resource (case) is clearly distinct from the sibling tools (account summary, account freeze), though the description stops short of explicitly naming those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied through the verb and resource—call this when you have a case_id and need case details. The tenant-boundary scoping hints at context, but there is no explicit when-not-to-use guidance, no mention of alternatives, and no condition that routes the agent to get_account_summary or request_account_freeze.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

request_account_freezeB

Request a high-impact account freeze. Policy always requires human approval.

NameRequiredDescriptionDefault
reasonYes
account_idYes
idempotency_keyYes

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It does reveal a key trait: human approval is always required, implying the request is not immediately executed. However, it does not disclose what happens after approval, whether it is asynchronous, what the response will be, or any side effects. Partial disclosure is better than nothing, but gaps remain.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The first sentence states the action and impact; the second adds the critical policy constraint. Every word earns its place and the structure is front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given three required parameters, no annotations, no output schema, and a high-impact action, the description is insufficiently complete. It does not explain parameter semantics, expected outcomes, or how to handle approval delays. An agent would need additional documentation or inference to use this tool correctly in a real flow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage and the description provides no parameter explanations. The parameter names (account_id, reason, idempotency_key) are somewhat self-explanatory, but the description adds zero meaning beyond the raw names. For a tool with three required parameters, the description should at least hint at their purpose, especially the idempotency key's role in preventing duplicate requests.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('request') and resource ('account freeze') and adds 'high-impact' to convey significance. It inherently distinguishes itself from the read-only sibling tools (get_case, get_account_summary) by being an action that modifies state.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, nor any exclusions or prerequisites. It mentions human approval is required, but that is a policy constraint, not a usage guide. An agent must infer that this tool is for freezing accounts, but there is no explicit comparison to sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.1.0
    • First observedget_account_summary
    • First observedget_case
    • First observedrequest_account_freeze

TDQS

A3.5/5.0

Scored across 3 tools

Disambiguation5/5

Each tool targets a distinct resource/action: case retrieval, account summary (with PII restriction), and a freeze request. There is no overlap in purpose, and the descriptions clearly differentiate the operations.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern (get_case, get_account_summary, request_account_freeze). The verbs are clear and the nouns identify the target, making the set predictable and easy to navigate.

Tool Count5/5

With only 3 tools, the server is tightly scoped and each tool serves a distinct, essential function within the policy gateway context. This is within the typical 3-15 range and feels appropriately lean rather than sparse.

Completeness3/5

The tools cover core read operations and a high-impact action, but there are notable gaps: no listing of cases or accounts, no update/modification paths, and no way to track the status of a freeze request. Agents would need to work around these missing operations.

Maintenance

ActivityNo data
ResponsivenessSyncing

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enforces fine-grained, context-aware access control on MCP tool calls, with a tamper-evident, replayable audit log that records denials and verifies every decision.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables governing tenant-aware MCP tools with policy enforcement, scoped access, human approval workflows, and tamper-evident audit logging.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents and MCP clients to safely access upstream MCP servers through centralized policy enforcement, including allow/deny/approval decisions, schema pinning, circuit breakers, and audit logging.
    MIT
  • F
    license
    Not graded
    quality
    B
    maintenance
    Enforces default-deny policies, budgets, and tamper-evident audit logging for MCP tool calls before they reach upstream servers.
    -