CLG adds mandate enforcement and signed receipts around MCP tool execution.
@clgplatform/mcp wraps MCP tool calls with a CLG decision gate.
For each tool execution attempt, it sends a decision request to CLG, blocks denied calls, allows approved calls, and emits signed receipts.
- mandate enforcement before tool execution
- signed decision receipts
- signed outcome receipts
- explicit deny path
- redaction hooks
- callbacks for decision/outcome/error
- fail-closed and fail-open behavior when CLG is unavailable
- does not verify receipts locally (use
@clgplatform/verify) - does not manage mandates itself (mandates are defined in CLG)
- does not cover MCP resources or prompts
- does not by itself guarantee legal or regulatory compliance
- does not replace broader governance controls
- Tool call is intercepted by the wrapper.
- Decision request is sent to CLG.
- CLG returns approved or denied.
- Tool executes only if approved.
- Outcome receipt is created after execution.
- Receipts can later be verified with
@clgplatform/verify.
npm install @clgplatform/mcp- CLG API key
- registered CLG agent
- mandate reference (
mandateRef) - MCP server using the official MCP SDK (
@modelcontextprotocol/sdk)
To try this against CLG Platform, use your CLG Platform account on clgplatform.com to obtain the API key, agent id, and mandate reference needed for the quick start below.
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { withCLG } from '@clgplatform/mcp';
const server = withCLG(new McpServer({ name: 'demo', version: '1.0.0' }), {
apiKey: process.env.CLG_API_KEY!,
agentId: 'demo-agent',
mandateRef: 'default',
});
server.registerTool('echo', { description: 'Echo' }, async (args) => ({
content: [{ type: 'text', text: JSON.stringify(args) }],
}));- Approve: tool handler runs, then an outcome receipt is emitted.
- Deny: tool handler is not run; a denied decision is surfaced (
CLGDeniedError).
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
apiKey |
string |
Yes | — | CLG API key |
agentId |
string |
Yes | — | Registered agent id |
mandateRef |
string |
Yes | — | Mandate reference used for decisioning |
workflowId |
string |
No | <agentId>-<timestamp> |
Workflow id for receipt chaining |
endpoint |
string |
No | https://api.clgplatform.com |
CLG API base URL |
failureMode |
'closed' | 'open' |
No | closed |
Behavior when CLG is unreachable |
timeoutMs |
number |
No | 5000 |
Decision request timeout |
redact |
(input) => input |
No | — | Redact payloads before sending to CLG |
beforeSend |
(envelope) => envelope |
No | — | Final mutation hook for decision envelope |
onDecision |
(result) => void |
No | — | Callback after CLG decision response |
onOutcome |
(receipt) => void |
No | — | Callback when outcome receipt is emitted |
onError |
(error) => void |
No | — | Callback for CLG wrapper errors |
redactfor payload-level redactionbeforeSendfor final decision-envelope mutationonDecisionfor decision telemetryonOutcomefor outcome telemetryonErrorfor wrapper error handling
After execution, verify signed receipts with @clgplatform/verify:
npm install @clgplatform/verify
clg-verify --public-key signing-key.pem receipt receipt.jsonBeta.
BUSL-1.1. See LICENSE.