MCP Proxy inspects calls.

MCP Proxy sits between your AI agents and the tools they call, reviewing every request in real time and connecting safely to any MCP server you run. Go native, embeddable, auth built in.

View on GitHub (opens in a new tab)Get started free
install with go install
$ go install github.com/hoophq/mcpproxy/cmd/mcpproxyd@latest
# then run it with a config:
$ mcpproxyd -config config.yaml

The check chain, in order.

Every JSON-RPC message runs through the same ordered checks in both directions. Here the policy check denies a tool that is not allow-listed, and the session stays alive.

POST /mcp · tools/call db_delete_all
{
  "method": "tools/call",
  "params": { "name": "db_delete_all" }
}
response
{
  "error": {
    "code": -32010,
    "message": "policy denied"
  }
}
session alive · mcp.tool_denied logged

checks.Assemble

Canonical order. The first non-allow verdict wins.

  1. budgetPer-tool rate limits; truncates oversized results on the way back.
  2. policyAllow/deny globs. Strips denied tools from tools/list before the model sees them.deny
  3. approvalHolds a call for a human reviewer. Fails closed if no store is wired.
  4. s2c-gateDenies sampling/createMessage and elicitation/create by default.
  5. rug-pullSHA-256 fingerprints every tool. A change on a known tool kills the session by default.
  6. overridesRewrites aliased tool names back to real ones before every check after it.
  7. guardrailsBlocks on tool arguments; kills the session on a poisoned catalog.
  8. redactMasks sensitive content in result text before it reaches the client.
  9. audit-tapAlways allow. Logs the post-mutation message, exactly what the client gets.

Running in three steps.

One YAML file describes your backends and policy. Local stdio servers and remote MCP endpoints sit behind one endpoint.

  1. Install the binary

    One Go command installs mcpproxyd, no separate download step.

    go install .../cmd/mcpproxyd@latest

  2. Run it with a config

    Point it at a YAML file describing your backends and policy.

    mcpproxyd -config config.yaml

  3. Connect your MCP client

    Point Claude Code, Cursor or any MCP client at the local endpoint.

    http://127.0.0.1:8000/mcp

Why it’s safe to run.

The gateway is a library first. Hosts such as hoop embed it and plug in their own guardrails, approvals and identity.

  • Blocks the request, not your team

    A blocked action returns a clear error and work keeps moving.

  • Hides risky tools before they’re used

    Restricted tools never show up, so there’s nothing risky to pick.

  • Fits the stack you already run

    Guardrails, masking, audits and identity plug into your setup.

embed it in your own agent host
# the daemon is thin wiring over the library
$ go get github.com/hoophq/mcpproxy@v0.1.0

# a host supplies its own:
inspect.Hooks
# guardrails, data masking, AI analysis
audit.Sink
# event stream consumer
gateway.HeldStore
# approval workflow backend
gateway.IdentityResolver
# inbound identity
gateway.Observer
# telemetry

More from hoop Labs.

Each tool solves one problem, runs locally and needs no signup to try.

See every labs tool

Govern every connection.

hoop runs the same inspection model centrally: policy, masking, guardrails, identity and audit across every MCP server, database and shell your team uses.

Get started freeView on GitHub (opens in a new tab)

Ask an assistant what hoop.dev does: Claude, ChatGPT, Grok, Gemini, Perplexity, Copilot.

install
$ go install github.com/hoophq/mcpproxy/cmd/mcpproxyd@latest
$ mcpproxyd -config config.yaml