03 · Actions: was each tool call checked inside attested hardware?
Check routed MCP tool calls and sign the evidence¶
cMCP is an MCP gateway that evaluates each routed tool call against Cedar policy, blocks denied calls in enforcing mode, and signs a TRACE session record a verifier can check offline.
Block a call in 10 minutes What this proves, and what it does not
TL;DR
Install cmcp-runtime 0.5.0 (MIT; the PyPI name cmcp belongs to an unrelated project) and see 403 POLICY_DENY locally, reported as partially_verified because software mode carries no hardware attestation. The SEV-SNP and Intel TDX verifiers are validated on real Azure and GCP evidence, and calls that bypass the gateway, along with NVIDIA GPU confidential computing, are outside what it proves today.
-
Run it
A blocked request and a signed session record on your laptop, with a mock tool and software attestation.
-
What it proves, and what it does not
Software mode has no hardware isolation, and the upstream tool server stays outside the TEE.
-
Hardware evidence
SEV-SNP on an Azure confidential VM and Intel TDX on GCP C3, validated 2026-07-27. NVIDIA GPU CC is not implemented.
-
The chain
Before it: Agent Manifest declares the agent. Alongside: cA2A covers delegation. After it: records in TRACE. Check a real TDX quote at agentrust-io.com/verify.
Choose your next step¶
| You want to… | Start here | Result |
|---|---|---|
| Understand a policy denial | Guided first demo | A blocked request and a signed session record |
| Exercise a real local upstream | Allow/deny quickstart | One denied tool call and one forwarded call |
| Connect an existing agent | MCP client integration | Your client sends requests through the gateway |
| Evaluate the trust boundary | How it works | Distinguish policy enforcement, signing, and hardware provenance |
| Deploy with hardware evidence | TEE attestation | Provider prerequisites and verification requirements |
| Implement against the protocol | Specification index | The relevant component, transport, and policy contracts |
What changes at the tool boundary¶
Authentication identifies a caller; your Cedar policy decides what a routed call may do. The gateway records the decision and binds the session's evidence into a signed claim when the session closes.
A hardware deployment can protect the runtime from its host, subject to the provider's threat model and verification support. The agent, model, and upstream tool server remain separate components. Calls that bypass the gateway are outside its enforcement. Host confidentiality also depends on the configured egress policy.
Read the architecture, enforcement modes, and limitations before treating a successful software demo as evidence of hardware isolation.
Get involved¶
For implementation bugs or specification feedback, include the failing command, runtime version, and expected behavior in an issue. See Contributing.
Status: cmcp-runtime 0.5.0 · MIT · hosting at the Agentic AI Foundation proposed, not accepted · Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects.