Protect MCP

Name: Protect MCP
Author: ScopeBlind

by ScopeBlindversion 0.32.4i★ –iRuns on your computer

Registry namecom.scopeblind/protect-mcp

Install

Overview

Description from the maker (original English)

Fail-closed Cedar policy gate + Ed25519 signed receipts for agent tool calls. Denies on any error.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "protect": {
      "command": "npx",
      "args": [
        "-y",
        "protect-mcp",
        "mcp"
      ]
    }
  }
}

Run this in your terminal

claude mcp add protect -- npx -y protect-mcp mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "protect": {
      "command": "npx",
      "args": [
        "-y",
        "protect-mcp",
        "mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "protect": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "protect-mcp",
        "mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified against the domain scopeblind.com (the registry checks domain ownership)
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 18336 servers in this category
Published to the registry more recently than 76% of the other 18336 servers in this category
Basic checks equal to or better than 100% of the other 18336 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Protect MCP safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.32.4) reached the registry 13 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, NexusWindows

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago

Install

NexusWindows

by pironjulien

Windows computer use in the background: desktop apps driven without your mouse or keyboard.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

protect-mcp

Local policy enforcement and signed decision receipts for AI agent tool calls.

Developer page · Quickstart · Agent setup · Policy packs · Sample record · Integrations · Documentation · Contribute

Put the gateway between an MCP client and its tool server, or use its hooks in a coding agent. Review a Cedar policy, enable enforcement, and keep a signed record of the decisions. Local evaluation and verification need no ScopeBlind account and send no decision telemetry.

Enforce at the tool boundary. Cedar denies on missing policies, engine errors or evaluation errors in fail-closed mode. Shadow mode is the default for the MCP wrapper: use --enforce when ready to block.
Check what was signed. Ed25519 receipts include the decision and policy digest. @veritasacta/verify checks the bytes against the public key you trust.
Start with existing tools. Use MCP stdio, the HTTP gateway or coding-agent hooks. Optional hosted collaboration has its own permissions and data flows.

A gateway covers calls routed through it. It is not an OS sandbox, and a signed receipt does not establish that an action executed or that no action was omitted. The security policy describes the boundary and reporting process.

See the result

A real local run: evaluate two proposed calls, sign the decisions, verify the receipts, then change a signed decision and check it again.

Watch the 14-second walkthrough

Text walkthrough and reproduction · Captured results

Try it without an agent

Use Node.js 22 and npm in a new directory. Install the pinned gateway and verifier:

mkdir protect-mcp-demo

cd protect-mcp-demo npm init -y npm install --save-exact protect-mcp@0.32.4 @veritasacta/verify@0.11.0

This example evaluates two proposed calls and signs their decisions. It does not execute either tool or run git push. Everything after installation is local.

# Create a starter policy and a private signing key.

npx --no-install protect-mcp init --starter

A normal read is allowed; a force-push to main is denied (exit 2).

npx --no-install protect-mcp evaluate --policy ./protect.cedar --tool Read --input '{"path":"README.md"}' npx --no-install protect-mcp evaluate --policy ./protect.cedar --tool Bash --input '{"command":"git push --force origin main"}' || test "$?" -eq 2

Evaluate again at signing time and record both decisions, in order.

npx --no-install protect-mcp sign --cedar builtin:starter --tool Read --input '{"path":"README.md"}' --key ./protect-mcp.key --receipts ./receipts npx --no-install protect-mcp sign --cedar builtin:starter --tool Bash --input '{"command":"git push --force origin main"}' --key ./protect-mcp.key --receipts ./receipts

Take only the public key from the key you generated, not from the receipt.

PROTECT_MCP_PUBLIC_KEY=$(node -p 'JSON.parse(require("fs").readFileSync("protect-mcp.key", "utf8")).publicKey') npx --no-install verify --replay-chain ./receipts/receipts.jsonl --key "$PROTECT_MCP_PUBLIC_KEY" --json

Change the signed deny to allow. The original receipt log stays intact.

node -e 'const fs=require("fs");const r=JSON.parse(fs.readFileSync("receipts/receipts.jsonl","utf8").trim().split("\n")[1]);r.payload.decision="allow";fs.writeFileSync("tampered.json",JSON.stringify(r))' npx --no-install verify tampered.json --key "$PROTECT_MCP_PUBLIC_KEY" --json || test "$?" -eq 1

<!-- readme-smoke:end -->

Expected: allow, then deny; both original receipt signatures and their link verify; the modified receipt reports invalid_signature. Keep protect-mcp.key private. To verify someone else's record, obtain their expected public key through an independent trusted channel.

Verifier exit codes are 0: valid, 1: invalid, 2: not checked/error. An invalid result is not necessarily tampering: the wrong expected key can also fail verification. Chain replay checks the supplied links; it does not establish that you received the entire history.

CI runs this exact example against the packed candidate and the pinned published verifier. See validation and releases.

Connect your agent

Choose the integration that matches your host and the coverage you need. Installing guidance skills does not enable enforcement. doctor checks local configuration; confirm the selected route with a real allowed and blocked call.

For the Claude Code plugin, first prepare and start the local gate, then install it in your project (Claude Code 2.1.295 or later):

claude plugin install protect-mcp --marketplace ScopeBlind/scopeblind-gateway --scope project

The plugin blocks routed tool calls while its gate is unavailable. Choose the plugin or standalone project hooks, so the same call is not recorded twice.

Use case	Start here
Wrap an existing MCP server	MCP setup and shadow-to-enforce workflow
Claude Code enforcement plugin	Plugin setup and local gate
Claude Code project hooks	Hook setup
Cursor project preview	Explicit setup, tool mapping and host checks
ChatGPT / Codex assistant preview	Setup guidance and a harmless verification demo, with no hooks
Existing Claude directory guidance plugin	Published plugin source, separate from enforcement
Call the policy evaluator as MCP tools	The gate as an MCP server
Host an HTTP gateway	HTTP deployment notes

Host compatibility and release status separates adapter tests from real-host validation. The Cursor and assistant packages are previews, not public directory listings. The standalone hook-format fixes ship in 0.32.4; its changelog lists what changed for each format. A format flag alone does not establish a working Codex, Gemini or Hermes integration.

For an existing MCP server, initialize its configuration in a separate directory from the example above, then run the wrapper with your server command:

npx --yes protect-mcp@0.32.4 init

npx --yes protect-mcp@0.32.4 --policy ./protect-mcp.json -- node your-mcp-server.js

This starts in shadow mode. Review the observed calls and policy before adding --enforce. wrap prints client configuration and exits; it is not the launch command. Full setup instructions.

Starter shell rules inspect command text. They are useful guardrails, but can miss alternate command spellings and can match harmless quoted text. Review the starter policy's coverage and limits before relying on it.

Integrations and contributions

Project	Connection
Microsoft AI Agents for Beginners	Educational contribution. protect-mcp's maintainer authored Lesson 18 on signing, verifying and chaining agent receipts.
Cedar for Agents	Upstream contribution. Contributed the WASM bindings that expose Cedar's Rust MCP schema generator to JavaScript and TypeScript.
wshobson/agents	Downstream integration. Ships a protect-mcp plugin with Claude Code policy and receipt hooks.
TRACE	Interoperability checks. Publishes Acta decision-receipt fixtures; our verifier reports its results against a pinned snapshot.

Sources, versions and check coverage.

Upgrading from 0.31

0.32.0 closes several ways around the gate. Some of them change how you start it:

--http listens on 127.0.0.1, and every request except GET /health needs Authorization: Bearer . Set the same PROTECT_MCP_HTTP_TOKEN (at least 32 characters) for the gateway and for the client or ingress that calls it. Use --host only when you mean to expose the port beyond this machine.
--enforce refuses to start when signing is configured but its key is missing or unreadable, and refuses an allowed call whose receipt cannot be signed.
--cedar with --policy applies both: a call needs a Cedar permit and must also pass that file's block, require_approval, rate limits and min_tier. Signing and credentials come from that file.
The dashboard accepts a change only from its own page, which carries a per-launch token.
Signing keys are written 0600 in a 0700 folder. For a key made by an earlier version, run chmod 600 keys/gateway.json; the gateway warns until you do.
A once approval at POST /approve names the exact action: the Request ID the gateway prints, tool:payload_hash. The approval nonce is on the gateway's stderr only.

See the changelog for every change.

Documentation

Local gateway guide: policies, hooks, dashboard, credentials and receipt compatibility.
Host compatibility: enforcement versus guidance, supported routes, test scope and release status.
Receipt and disclosure guide: local records, selective disclosure and optional hosted digest anchoring.
Command reference.
Reproducible visual demo: captured results and rendering scripts.
Integrations and contributions: source links, versions and the scope of published interoperability checks.
Hosted coordination: separate human approvals, invoice sandbox and repository review workflows.
Release validation and provenance.
Changes by version.

Contribute

Start with a bounded [help-wanted task](https://github.com/ScopeBlind/scopeblind-gateway/issues?q=is%3Aissue%20is%3Aopen

Only the beginning is shown; read the rest in the repo

Protect MCP

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

NexusWindows

README from the maker

protect-mcp

See the result

Try it without an agent

A normal read is allowed; a force-push to main is denied (exit 2).

Evaluate again at signing time and record both decisions, in order.

Take only the public key from the key you generated, not from the receipt.

Change the signed deny to allow. The original receipt log stays intact.

Connect your agent

Integrations and contributions

Upgrading from 0.31

Documentation

Contribute