Aggrete is an MCP proxy that sits between AI assistants and your connectors. It checks each tool call against a YAML policy and per-user memory, and refuses the request that would leak a secret, cross an information barrier, over-share health data, complete a forbidden combination, or write out after reading untrusted content, before the upstream is ever contacted.
pip install aggrete
pip install aggreteaggrete --demo to watch it refuseuvx aggrete --demodocker run --rm ghcr.io/aggrete/aggrete --demoA rule can say approve instead of deny. The call pauses before anything is fetched, the clause owner gets the ping, and the retry works for a few hours with their name on every audit line.
Native in agentgateway over its ExtMCP hook, two interceptors for Docker's MCP gateway, a plugin for IBM ContextForge, and an OpenID AuthZEN endpoint for anything else. Same rules, memory and audit.
How adapters workOne command runs sixteen checks against the real components and maps them onto OWASP, CoSAI and AIUC-1. A second mode scores any gateway from the outside, including ones that are not Aggrete.
See the reportEverything it does, in plain words, with what engineers call it in grey. Hover any line for a sentence more.
Every security tool says it blocks these. Aggrete ships the test. Sixteen checks drive the real engine and map onto the lists buyers ask about, and a black-box mode scores any MCP gateway from the outside.
pip install aggrete && aggrete conformanceof 10 controls, 0 failing
of 10 controls, 0 failing
of 14 controls, 0 failing
of 18 controls, 0 failing
Two real runs over MCP. The right-hand column is the same fixture connector with no policy layer in front of it. Full report, every control, and how to point it at your own gateway →
The pre-call gate, the accumulator, the audit chain, and the rule types.
connectorsSlack, GitHub, Drive, Jira, Salesforce and Notion, governed the same way.
handbook to policyPaste your handbook and watch clauses turn into enforceable YAML rules.
get startedInstall, write the policy, wire the upstreams, and pick how to run it.