AI reasons.
MCPIP authorizes.
Systems execute.
A deterministic gate between agent reasoning and your systems of record — every action allowed or denied before it executes, every verdict sealed into a signed, tamper-evident record. The model never holds the pen.
◐ every decision WORM-sealed before execution
the pipeline
Four stages between a model's idea and a committed fact.
MCPIP does not try to make the model trustworthy. It assumes reasoning will be manipulated, and guarantees — architecturally, not persuasively — that compromised reasoning is insufficient to produce a protected state change. No stage can be skipped from the model's side.
One ingress, every framework.
Any provider dialect — OpenAI, Claude, Gemini, Bedrock, raw MCP, A2A — normalizes into one strict intent. Malformed, oversized, or smuggled payloads are rejected at the door rather than interpreted.
strict schema · rejected at the door
Obfuscation as a defense.
Agents call opaque aliases; real systems stay invisible. The model only ever sees skill_payroll_run — a compromised agent cannot even name what it wants to hit.
UNKNOWN_ALIAS · CROSS_TENANT → deny
Identity is sovereign.
Identity comes only from a verified token — never from anything the agent can set for itself. High-risk calls stage a confirmation bound to the exact request; change one value and nothing executes.
payload-bound · consume-once
Write-before-execute.
Every allow and every deny is sealed into a signed, tamper-evident record before the side effect fires. Tampering breaks the chain. Silence is impossible.
signed · hash-chained · WORM
why mcpip
The whole market watches, filters, or identifies. MCPIP decides — and proves it.
Every adjacent category solves a real problem. None of them stands inline and returns a deterministic, payload-level verdict that is sealed before the action runs. Six properties set the gateway apart — each one an outcome the architecture enforces.
obfuscation as a defense
Agents never learn your real systems.
The model only ever sees a neutral, opaque alias — never a hostname, service, or endpoint. A compromised agent cannot enumerate your estate or even name what it wants to reach.
vs gateways · identity platforms
payload-bound step-up
Approval is bound to the exact payload.
A human step-up approves this action with these arguments. Change one byte after approval — a recipient, an amount, a path — and it is denied. An approval never transfers to a different action.
vs approval / PAM planes
write-before-execute
The record is sealed before the action runs.
Every verdict is written into a signed, tamper-evident record before the side effect fires. Unlike a log written after the fact, the evidence provably predates what it approves.
vs after-the-fact loggers
deterministic authorization
Deterministic verdicts, not model guesses.
No ML scoring, no heuristics, no second model to prompt-inject. The same call yields the same verdict every time, reproducible and explainable byte-for-byte.
vs guardrails · ML scanners
fail-closed
Fails closed, every time.
Misconfiguration, missing state, a lost race, or any doubt means deny — and the caller learns only a correlation id. There is no fast path that quietly under-enforces.
vs allowlist gateways
independent · self-hosted
Runs in your perimeter. Calls no model.
Self-hosted or fully air-gapped, the gateway is inference-free and never holds your vendor keys. It authorizes; it never becomes a new place your credentials live.
vs SaaS-only platforms
| Can it… | LLM guardrails | AI / MCP gateways | Identity platforms | MCPIP |
|---|---|---|---|---|
| Deterministic payload-level authorization | ✕ | – | ✕ | ✓ |
| Approval bound to the exact payload | ✕ | ✕ | ✕ | ✓ |
| Target hidden from the agent | ✕ | ✕ | ✕ | ✓ |
| Evidence sealed before execution | ✕ | – | – | ✓ |
| Fails closed by default | ✕ | – | – | ✓ |
| Self-hosted & air-gap deployable | – | – | ✕ | ✓ |
the guarantee
Seven guarantees hold on every request — or the request does not run.
They are not policy suggestions; they are enforced by the architecture, on every call, whatever the model was persuaded to ask for. The full adversary model lives on the security page.
falsifiable · on your machine
$ ./scripts/quickstart_demo.sh
◐ 10/10 gates held · exit 0
◐ zero → governed call: 7s974
tests, all green
10/10
adversarial gates held
developers · self-serve
Register your first agent in minutes.
No signup, no sales call. Name an agent, mint a scoped identity in the sandbox, and make a governed call. Everything below is generated for your agent name — real commands, ready to paste.
registers as my-agent
Framework
# 1 · start the sandbox (once) — zero to a live gateway on :8080
mcpip up
# 2 · register your agent — mint a scoped, short-lived identity
mcpip --context sbx sandbox dev-token --agent my-agent
# 3 · make your first governed call
mcpip --context sbx authorize skill_spend_summary --arg period=2026-Q2connect
One gateway URL. Every surface you already run.
MCP host, REST, CLI, or SDK — the same pipeline authorizes all of it. These are the actual wire surfaces, not pseudocode; copy one and point it at your gateway.
# BLESSED — zero manual token. The repo ships .mcp.json with a
# self-minting, auto-refreshing stdio bridge for Claude:
cd mcpip && claude # Claude Code discovers .mcp.json
# then: /mcp -> approve "mcpip". the bridge mints + refreshes the JWT.
# ADVANCED — point any HTTP MCP host straight at the edge and bring your own
# Bearer. NB a sandbox dev-token EXPIRES in ~5 min; after that every call is an
# opaque deny that looks like a broken connect (it isn't — the token lapsed):
{
"mcpServers": {
"mcpip": {
"type": "http",
"url": "http://localhost:8080/v1/mcp",
"headers": { "Authorization": "Bearer <jwt>" }
}
}
}one gate · every surface
Agents only ever name an opaque alias; a deny is a correlation id, never a reason. The step-by-step guide covers every surface end to end.
design-partner program
Put your scariest workflow behind the gate.
Payments, ledger postings, infrastructure teardown. A time-boxed pilot on one real workflow, self-hosted inside your boundary, reviewed by an engineer — not a funnel.
no data-sharing agreement to evaluate · the artifact runs inside your own perimeter
Request Sandbox Artifact
Evaluate it inside your own perimeter.
MCPIP ships as a signed, hardened Docker artifact built to run inside your internal IT sandbox. It contains no vendor telemetry; your firewall/VPC/CNI enforces and proves the required no-egress deployment posture. Access is scoped, staged, and, like everything else here, gated.
- 01Request is staged and reviewed
- 02Signed sandbox artifact delivered for cosign verification
- 03Production gates negotiated per policy
access_request
draft