Enforce identity, least privilege, deterministic risk, policy, and governed approvals before MCP tool calls reach downstream systems.
Enforcement stack
Gatekeeper sits between AI agents and MCP servers, evaluates the full security context, and forwards only allowed actions.
Authenticate known agents, then enforce exact allow and deny permissions with least-privilege defaults.
Score every request from tool metadata and workflow context, then apply priority-ordered, fail-closed policy.
Route sensitive actions through role-bound approvals with escalation, timeouts, fallback reviewers, and controlled break-glass.
Bind approval to the reviewed tool, destination, arguments, environment, and security context—and allow one execution only.
Track sensitive-data access across an agent session and block unsafe external sends before downstream execution.
Dry-run proposed policy behavior with zero downstream actions and retain structured, redacted decision evidence.
Request path
Gatekeeper authenticates the agent, checks permissions and session state, scores risk, evaluates policy, and invokes approval workflows when required.
Read the architecture on GitHubV2 evaluation
Results from the repository’s generated deterministic evaluation report. Blocked paths recorded zero downstream execution.
Latency measures the local in-process deterministic evaluator only; it excludes network and downstream tool latency.Inspect the full report ↗
Pricing
Gatekeeper is available free from the public GitHub repository, including the gateway, safe demo MCP servers, policy configuration, tests, and the V2 evaluation harness.
View on GitHubQuick start
git clone https://github.com/Grevanur/gatekeeper-mcp.gitcd gatekeeper-mcppython3 -m venv .venv && source .venv/bin/activatepython -m pip install -e '.[dev]' && cp .env.example .envuvicorn app.main:app --reloadThen open http://127.0.0.1:8000/docs for the local API documentation.
Scope, stated plainly
The current deterministic evaluation does not prove resistance to prompt injection, malicious downstream-server internals, covert channels, compromised hosts or approver accounts, enterprise identity federation, or distributed consistency failures.