Govern tool calls. Verify the evidence.¶
cMCP (Confidential MCP) is an open-source gateway between your AI agent's MCP client and its tool servers. It checks routed calls against Cedar policy, blocks denied calls in enforcing mode, and produces a signed TRACE session record.
Block a call in 10 minutes See the architecture
The first demo runs on your laptop with a mock tool and software attestation. You will see 403 POLICY_DENY, then the expected partially_verified result because no hardware attestation is present. It needs Python 3.11+ and no cloud account.
Choose your next step¶
| You want to… | Start here | Result |
|---|---|---|
| Understand a policy denial | Guided first demo | A blocked request and a signed session record |
| Exercise a real local upstream | Allow/deny quickstart | One denied tool call and one forwarded call |
| Connect an existing agent | MCP client integration | Your client sends requests through the gateway |
| Evaluate the trust boundary | How it works | Distinguish policy enforcement, signing, and hardware provenance |
| Deploy with hardware evidence | TEE attestation | Provider prerequisites and verification requirements |
| Implement against the protocol | Specification index | The relevant component, transport, and policy contracts |
What changes at the tool boundary¶
Authentication identifies a caller; your Cedar policy decides what a routed call may do. The gateway records the decision and binds the session's evidence into a signed claim when the session closes.
A hardware deployment can protect the runtime from its host, subject to the provider's threat model and verification support. The agent, model, and upstream tool server remain separate components. Calls that bypass the gateway are outside its enforcement. Host confidentiality also depends on the configured egress policy.
Read the architecture, enforcement modes, and limitations before treating a successful software demo as evidence of hardware isolation.
How it fits AgenTrust¶
Agent Manifest declares identity and intended authority. cMCP governs the MCP tool-call path. TRACE defines signed runtime evidence, and cA2A addresses delegation between agents. Use the components required by your application's trust boundaries.
For implementation bugs or specification feedback, include the failing command, runtime version, and expected behavior in an issue. See Contributing.