get mcpip
Running in one command. Governed in three.
MCPIP is source-available and self-hosted — no signup, no cloud account, no data leaving your machine. Clone it, bring it up, and make a real governed call in about five minutes. Everything below runs against the repository today.
plug & play
Zero to a governed call.
Clone the gateway
The full source-available gateway, SDKs, and CLI — one repository, nothing to sign up for.
Clone the gateway
The full source-available gateway, SDKs, and CLI — one repository, nothing to sign up for.
git clone https://github.com/katzyuval/mcpip && cd mcpipBring it up
The sandbox stands up the whole pipeline — Bridge, Obfuscator, Auth, and the WORM audit — on http://localhost:8080. Redis included.
Bring it up
The sandbox stands up the whole pipeline — Bridge, Obfuscator, Auth, and the WORM audit — on http://localhost:8080. Redis included.
./scripts/quickstart_demo.sh
# or, with the CLI installed:
mcpip upAuthorize a call — and watch it land
Log in once to create the sbx context, mint a scoped sandbox identity, and authorize a real skill. This is the proof: the verdict is sealed into the signed WORM log before the call runs — watch the entry and its correlation_id appear live in the console’s audit feed. A deny returns only MCPIPDenied + a correlation_id, never a reason.
Authorize a call — and watch it land
Log in once to create the sbx context, mint a scoped sandbox identity, and authorize a real skill. This is the proof: the verdict is sealed into the signed WORM log before the call runs — watch the entry and its correlation_id appear live in the console’s audit feed. A deny returns only MCPIPDenied + a correlation_id, never a reason.
mcpip login --gateway http://localhost:8080 --sandbox --context sbx
mcpip --context sbx sandbox dev-token --agent demo
mcpip --context sbx authorize skill_spend_summary --arg period=2026-Q2you’re done — here’s the proof
The authorize call returns an allow verdict, and a signed line lands in the WORM feed before the call executes. That line — with its correlation_id — is your “it’s governed” moment, the way a first event landing in an analytics tool tells you the SDK is wired.
allow skill_spend_summary correlation_id=c1f2a9e4
WORM #184 sealed sha256:9b3e…7d ed25519 ✓ (written before execution)install options
However you ship, it fits.
Pick the path that matches your stack — one at a time.
one-liner · macOS / Linux
Install the CLI
The fastest start — installs the mcpip CLI in one line, user-space only (no root). Then `mcpip up` brings up the sandbox. Inspect it first if you like: pipe to less instead of bash.
curl -fsSL https://raw.githubusercontent.com/mcpip-security/mcpip/main/install.sh | bash
mcpip upverify what you run
Signed, and re-checked at every boot.
Every release is a set of SHA-256 artifact digests signed with an offline Ed25519 release key, plus a source integrity manifest the gateway re-hashes on startup — a tampered file fails the boot closed. There is no auto-updater: MCPIP never pulls code or patches itself. Upgrading is your change-control action — verify a signed release, pin its digest, redeploy.
signed releases on GitHub →licensing
Free to self-host. Forever.
- Gateway core — BSL 1.1 — source-available; read it, self-host it, modify it, free forever. Converts to Apache-2.0 on the change date.
- SDKs & CLI — Apache-2.0 — integrate without friction.
- Enterprise — A signed entitlement unlocks the production tiers (SSO, HA, long-term evidence, support). Priced per governed agent.
Full setup, step by step.
Environment, licensing, the step-up ceremony, deployment, and the audit stream — the complete developer reference.