BY HOOP.DEV / OPEN SOURCE

Every request,
inspected before it lands.

MCP Proxy sits between your AI agents and the tools they call, reviewing every request in real time and connecting safely to any MCP server you run.

Open SourceGo nativeEmbeddable

How it works

The resolver authenticates every call: OIDC, a static token, GitHub, or AWS STS.

Mcp-Session-Id: sess_8f2a1c

Client and server traffic run the same ordered check chain; the first non-allow verdict wins.

budget → policy → … → audit-tap

A blocked call gets a JSON-RPC error; the session survives unless integrity is violated.

-32010 policy denied

The check chain, in order

POST /mcp

tools/call · db_delete_all

{
  "method": "tools/call",
  "params": { "name": "db_delete_all" }
}

{
  "error": {
    "code": -32010,
    "message": "policy denied"
  }
}

checks.Assemblecanonical order · first non-allow verdict wins

01budgetPer-tool rate limits; truncates oversized results on the way back.

02policyAllow/deny globs. Strips denied tools from tools/list before the model sees them.

03approvalHolds a call for a human reviewer. Fails closed if no store is wired.

04s2c-gateDenies sampling/createMessage and elicitation/create by default.

05rug-pullSHA-256 fingerprints every tool. A change on a known tool kills the session.

06overridesRewrites aliased tool names back to real ones before every check after it.

07guardrailsBlocks on tool arguments; kills the session on a poisoned catalog.

08redactMasks sensitive content in result text before it reaches the client.

09audit-tapAlways allow. Logs the post-mutation message, exactly what the client gets.

Why it’s safe to run

A blocked action returns a clear error and work keeps moving.

Restricted tools never show up, so there’s nothing risky to pick.

Guardrails, masking, audits, and identity plug into your setup.

Need it built into your own platform?

MCP Proxy is a library, not just a standalone app. Plug in your own tools and identity provider, and run it anywhere your agents do.

✦ ASK AI WHAT HOOP.DEV DOES

Every request,inspected before it lands.