Show HN: cMCP, deny an AI agent's tool call and get a signed receipt

Aug 05, 2026 01:06 AM - 1 hour ago 2

Enforce MCP instrumentality argumentation wrong a TEE, wherever the supplier it governs cannot scope it

Documentation

Quick Start · Architecture · Configuration · CLI · Changelog

MIT PyPI OpenSSF Scorecard Discord

Developer Preview - launched astatine the Confidential Computing Summit, June 23 2026. May person breaking changes earlier v1.0. See STATUS.md for precisely what ships coming versus what is connected the roadmap.

cMCP (Confidential MCP Runtime) is the secure, confidential measurement to tally MCP: an open-source gateway that enforces MCP tool-call argumentation wrong a hardware Trusted Execution Environment (TEE). Every instrumentality telephone is intercepted, evaluated against a Cedar argumentation bundle, and enforced wherever the process it governs cannot scope it. Each convention produces a signed TRACE Claim that a verifier checks without trusting the operator, hardware-attested erstwhile the gateway runs successful a TEE and signed-only successful package mode. If you are looking for a unafraid type of MCP, this is the AgenTrust runtime for it.

TL;DR - Point your supplier astatine the cMCP Gateway. It evaluates each instrumentality telephone against a Cedar argumentation wrong a TEE, blocks aliases redacts what the argumentation denies, and emits a tamper-evident TRACE Claim arsenic proof. Run pip instal cmcp-runtime and commencement successful package mode pinch nary hardware required.

Your supplier calls Snowflake, Salesforce, a twelve APIs. What stops it from leaking a customer's information connected 1 of those calls? If a regulator asks, could you beryllium it didn't?

An supplier calls a tool. The argumentation motor says allow. The instrumentality telephone goes through.

None of that proves the argumentation motor itself was not compromised. Software-only MCP governance cannot guarantee:

The Cedar argumentation connected disk is the 1 that ran. A rogue admin tin switch the bundle aft approval; the hash cheque runs wrong the aforesaid OS the admin controls.
The allow/deny determination was not flipped successful memory. A proviso concatenation CVE successful the evaluator runs successful the aforesaid reside abstraction arsenic the attacker.
The audit log reflects what really happened. Any statement holding the package signing cardinal tin reconstruct a valid audit concatenation aft the fact.

The power level that governs instrumentality calls must tally wherever it cannot beryllium reached by the process it governs.

Hardware-attested argumentation enforcement for MCP instrumentality calls. Every instrumentality telephone is intercepted, evaluated against a Cedar argumentation bundle, and enforced by a argumentation motor moving wrong a Trusted Execution Environment (TEE). The argumentation bundle hash is measured into the hardware attestation study earlier immoderate codification runs.

Unlike tunnel-based connectivity solutions, the cMCP Runtime processes tool-call payloads wrong the TEE. The connectivity supplier sees ciphertext, not plaintext. The only point that leaves the enclave is the signed TRACE claim.

Create cmcp-config.yaml:

attestation: provider: auto enforcement_mode: advisory # advisory eases first-run tuning; the default is `enforcing` policy_bundle_path: ./policies/ catalog_path: ./catalog.json

Start the gateway:

CMCP_DEV_MODE=1 cmcp commencement --config cmcp-config.yaml

Make a instrumentality call:

curl -X POST http://localhost:8443/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"salesforce.contacts","arguments":{"query":"Acme Corp"},"_cmcp":{"session_id":"s1","workflow_id":"demo-agent"}}}'

See docs/quickstart.md for the afloat walkthrough: Cedar policy, instrumentality catalog, first TRACE Claim, and verification (no hardware TEE required).

The supplier sends each instrumentality telephone to the cMCP Gateway alternatively of straight to MCP servers.
At startup the gateway measures the Cedar argumentation bundle hash into the hardware attestation report. No codification runs earlier this measurement.
Each incoming instrumentality telephone is evaluated by the Cedar argumentation motor moving wrong the TEE. The consequence is allow, deny, aliases redact. The telephone and its determination are appended to the hardware-sealed audit chain.
At the extremity of the convention the gateway produces a TRACE Claim: a signed, hardware-attested artifact that records which devices ran, which argumentation decided each call, and the afloat audit chain. A verifier checks this without trusting the operator.

Agent -> cMCP Runtime -> Cedar Policy Engine (TEE) -> Tool | GatewayClaim (TRACE Profile) +-- trace.eat_profile +-- trace.runtime.platform + measurement +-- trace.policy.bundle_hash +-- trace.cnf.jwk (Ed25519 confirmation key) +-- gateway.audit_chain (root/tip/length) +-- signature (Ed25519 complete canonical JSON)

Provider Platform Assurance Notes

tpm	TPM 2.0 / vTPM (Azure, AWS, GCP Trusted Launch)	Medium	Local TPM quote
sev-snp	AMD SEV-SNP (Azure DCasv5, AWS C6a Nitro)	High	AMD KDS
tdx	Intel TDX (Azure DCedsv5, GCP C3)	High	Intel PCS
gpu-cc (v0.2)	NVIDIA H100/H200/Blackwell (CC mode)	High	NVIDIA Remote Attestation Service (NRAS)
opaque (opt-in)	OPAQUE Confidential Runtime	n/a (not yet implemented)	Placeholder: excluded from auto-detect; selecting it explicitly raises a not-implemented error

Provider auto-detect probe order: azure-cvm -> tpm -> sev-snp -> tdx. The first supplier whose detect() succeeds is selected. opaque is simply a not-yet-implemented placeholder: it is excluded from auto-detect, and selecting it explicitly raises ATTESTATION_PROVIDER_NOT_IMPLEMENTED alternatively than falling done silently. If nary hardware supplier is detected, the gateway starts only nether CMCP_DEV_MODE=1 (a non-attested software-only fallback) and different refuses to start.

from cmcp_runtime.config import TEEProvider # Auto-detect (default) # attestation.provider: car -> azure-cvm -> tpm -> sev-snp -> tdx # (software-only is utilized only nether CMCP_DEV_MODE=1) # Explicit hardware selection # attestation.provider: sev-snp # OPAQUE Managed Runtime (opt-in only; not yet implemented) # OPAQUE_ATTESTATION_URL=https://... cmcp commencement --config cmcp-config.yaml

Mode Behavior Use case

enforcing	Policy denies return HTTP 403; telephone is not forwarded	Production
advisory	Policy denies are logged; telephone proceeds	First deployment, argumentation tuning
silent	Policy is evaluated but thing is logged aliases blocked	Baselining

Default is enforcing. Set enforcement_mode: advisory successful cmcp-config.yaml to usage advisory mode.

cmcp-config.yaml afloat reference:

attestation: provider: auto # car | tpm | sev-snp | tdx | opaque | software-only enforcement_mode: enforcing # enforcing | advisory | silent validity_seconds: 86400 # attestation freshness model (default: 24 hours) staleness_policy: fail_closed # fail_closed | warn_only expected_measurement: ~ # pin a circumstantial PCR/measurement (optional) policy_bundle_path: policies/ # directory containing .cedar files and manifest.json catalog_path: catalog.json # approved instrumentality catalog listen_addr: "0.0.0.0:8443" max_response_size_bytes: 2097152 # 2 MB default policy_reload_interval_seconds: 0 # 0 = disabled; restart required to update policy

Environment variables:

Variable Effect

CMCP_DEV_MODE=1	Use software-only TEE provider; nary hardware required
CMCP_BEARER_TOKEN	Require this bearer token connected each inbound requests
OPAQUE_ATTESTATION_URL	Enable OPAQUE Managed Runtime attestation (explicit opt-in)

Command Flags Description

cmcp start	--config PATH (required)	Start the gateway
cmcp validate-config	--config PATH (required)	Validate cmcp-config.yaml without starting
cmcp validate-bundle	--bundle-path PATH (required), --expected-hash sha256:<hex> (required)	Verify a Cedar bundle hash earlier deployment
cmcp verify	CLAIM_FILE (required); --policy-hash, --catalog-hash, --max-age, --trusted-key, --audit-bundle, --agent-manifest, --agent-manifest-trust-anchor	Verify a signed TRACE Claim (signature, schema, freshness, audit chain, and pinned hashes)

A GatewayClaim is the portion of impervious handed to an auditor, regulator, aliases downstream verifier. It is produced per convention (or per call, configurable) and signed pinch a cardinal that ne'er leaves the TEE.

Field Description

trace.eat_profile	EAT floor plan URI: tag:agentrust-io.com,2026:trace-v0.2
trace.runtime	TEE level and hardware measurement recorded astatine enclave boot
trace.policy.bundle_hash	SHA-256 of the Cedar bundle loaded astatine startup; changing immoderate argumentation record changes this value
trace.cnf.jwk	Ed25519 nationalist cardinal bound to the TEE signing key
trace.tool_transcript	Audit-chain-derived per-call view: hash (binds to the audit concatenation tip), call_count, and privacy-preserving entries (tool name, information class, decision)
gateway.audit_chain	Hash-chained audit log guidelines and tip; verifiable without replaying individual entries
signature	Ed25519 complete canonical JSON of the afloat declare assemblage (RFC 8785)

(This array is simply a summary of the most-used fields.)

Verification pinch the cmcp_verify room does not require trusting the operator. The verifier checks the signature against the TEE-bound key, the argumentation bundle hash against the approved value, and the audit concatenation for soul consistency.

The normative schema is schemas/trace-claim.schema.json, and docs/quickstart.md shows a complete example. See docs/spec/verification-library.md and the TRACE specification for the afloat verification protocol.

Standard Coverage

OWASP Agentic AI Top 10	MCP10 (data leakage via instrumentality calls), MCP02 (unsanctioned tools), MCP08 (provable governance), MCP04 (supply chain)
NIST SP 800-207	Policy determination constituent wrong TEE; nary implicit spot successful workload identity
EU AI Act Art. 12, 15	Per-decision audit records (Art. 12); TEE-backed cybersecurity controls (Art. 15)
DORA Art. 9	Attestation chain; audit log retention via gateway.audit_chain
RATS/EAT RFC 9711	GatewayClaim is an EAT; eat_profile section identifies the TRACE profile

Tool What it checks

ruff	Style and import linting connected each PR
bandit	Python information linting connected each PR
pip-audit	Dependency vulnerability scan connected each PR
mypy	Static type checking connected each PR
CodeQL	Python SAST, security-extended queries, weekly
OpenSSF Scorecard	Weekly scoring, SARIF upload

See SECURITY.md for vulnerability reporting and consequence SLAs. See LIMITATIONS.md for definitive scope boundaries, including residual risks for APM payload capture, runtime config injection, and P4.1 proviso concatenation (typosquat) that Phase 1 does not close.

cMCP (Confidential MCP Runtime) is an open-source gateway that enforces MCP tool-call argumentation wrong a hardware Trusted Execution Environment. It intercepts each instrumentality call, evaluates it against a Cedar argumentation bundle, enforces the determination (allow, deny, aliases redact), and records the telephone successful a hardware-sealed audit chain.

How is cMCP different from software-only MCP governance?

Software-only governance runs the argumentation motor successful the aforesaid OS an usability aliases a supply-chain CVE tin reach, truthful it cannot beryllium the argumentation that ran was the approved 1 aliases that the determination was not flipped successful memory. cMCP runs the argumentation motor wrong a TEE and measures the Cedar bundle hash into the hardware attestation study earlier immoderate codification runs, truthful the power level cannot beryllium reached by the process it governs.

Do I request typical hardware to effort it?

No. Set CMCP_DEV_MODE=1 to usage the software-only TEE supplier and tally the afloat quickstart without a hardware TEE. Hardware providers (TPM, AMD SEV-SNP, Intel TDX, OPAQUE) are utilized successful production.

A TRACE Claim (a GatewayClaim) is simply a signed, hardware-attested artifact produced per session. It records which devices ran, which argumentation decided each call, the Cedar bundle hash, and the audit chain, and it is signed pinch an Ed25519 cardinal that ne'er leaves the TEE. A verifier checks it pinch the cmcp_verify room without trusting the operator.

Which TEE providers are supported?

TPM 2.0 / vTPM, AMD SEV-SNP, and Intel TDX, pinch NVIDIA GPU confidential computing planned for v0.2 and OPAQUE Confidential Runtime disposable arsenic definitive opt-in. Auto-detection bid is Azure confidential VM, past TPM 2.0 / vTPM, past AMD SEV-SNP, past Intel TDX; the software-only supplier is utilized only nether CMCP_DEV_MODE=1.