get mcpip
Running in one command. Governed in three.
MCPIP is source-available and self-hosted — no signup, no cloud account, no data leaving your machine. Clone it, bring it up, and make a real governed call in about five minutes. Everything below runs against the repository today.
plug & play
Zero to a governed call.
Clone the gateway
The full source-available gateway, SDKs, and CLI — one repository, nothing to sign up for.
Clone the gateway
The full source-available gateway, SDKs, and CLI — one repository, nothing to sign up for.
git clone https://github.com/mcpip-security/mcpip.git && cd mcpipBring it up
The sandbox stands up the whole pipeline — Bridge, Obfuscator, Auth, and the WORM audit — on http://localhost:8080. Redis included. It builds its own .venv for the gateway and does not install the mcpip command — step 3 does that. (Already have the CLI? `mcpip up` is the same thing.)
Bring it up
The sandbox stands up the whole pipeline — Bridge, Obfuscator, Auth, and the WORM audit — on http://localhost:8080. Redis included. It builds its own .venv for the gateway and does not install the mcpip command — step 3 does that. (Already have the CLI? `mcpip up` is the same thing.)
./scripts/quickstart.shAuthorize a call — and watch it land
Log in once to create the sbx context, mint a scoped sandbox identity, and authorize a real skill. This is the proof: the verdict is sealed into the signed WORM log before the call runs — watch the entry and its correlation_id appear live in the console’s audit feed. A deny returns only MCPIPDenied + a correlation_id, never a reason.
Authorize a call — and watch it land
Log in once to create the sbx context, mint a scoped sandbox identity, and authorize a real skill. This is the proof: the verdict is sealed into the signed WORM log before the call runs — watch the entry and its correlation_id appear live in the console’s audit feed. A deny returns only MCPIPDenied + a correlation_id, never a reason.
pipx install ./sdk/python # pip needs a venv on PEP 668 pythons
mcpip login --gateway http://localhost:8080 --sandbox --context sbx
mcpip --context sbx sandbox dev-token --agent ops-1
mcpip --context sbx authorize skill_spend_summary --arg period=2026-Q2you’re done — here’s the proof
The authorize call returns an allow verdict, and a signed line lands in the WORM feed before the call executes. That line — with its correlation_id — is your “it’s governed” moment, the way a first event landing in an analytics tool tells you the SDK is wired.
allow skill_spend_summary correlation_id=c1f2a9e4
WORM #184 sealed sha256:9b3e…7d ed25519 ✓ (written before execution)install options
However you ship, it fits.
Pick the path that matches your stack — one at a time.
one-liner · macOS / Linux
Install the CLI
Installs the mcpip CLI in one line, user-space only (no root). `mcpip up` then boots the sandbox from a source checkout, so clone the repository too — it is where the gateway and the walkthrough live. mcpip.ai/install.sh only redirects to the script in the repository — it is never served from here, so what you run is what you can read. Inspect it first if you like: pipe to less instead of bash, or fetch it straight from the source at https://raw.githubusercontent.com/mcpip-security/mcpip/main/install.sh
curl -fsSL https://mcpip.ai/install.sh | bash
git clone https://github.com/mcpip-security/mcpip.git && cd mcpip
mcpip upverify what you run
Re-checked at every boot.
The gateway ships a source integrity manifest it re-hashes on startup — a tampered file fails the boot closed. The release-signing tooling is in the repo (scripts/gen_release_keys.py, scripts/sign_release.py): a set of SHA-256 artifact digests signed with an offline Ed25519 release key. There is no auto-updater — MCPIP never pulls code or patches itself; upgrading is your change-control action.
No tagged, signed release has been published for download yet — today you build from source at main.
licensing
Free to self-host. Forever.
- Gateway core — BSL 1.1 — source-available; read it, self-host it, modify it, free forever. Converts to Apache-2.0 on the change date.
- SDKs & CLI — Apache-2.0 — integrate without friction.
- Enterprise — A signed entitlement unlocks the production tiers (HA, long-term evidence, support; SSO planned). Priced per governed agent.
Full setup, step by step.
Environment, licensing, the step-up ceremony, deployment, and the audit stream — the complete developer reference.