MCP security tooling falls into a few honest categories, and they mostly solve different problems. This is where each fits, and where Aggrete is genuinely different, without pretending it does everything.
Scanners (mcp-scan, truecopy, and similar) inspect a server or tool before you install it and flag known-bad or poisoned definitions. Essential hygiene, but they run once, at install, and do not govern what happens at runtime.
Model guardrails classify prompts and outputs at the edge. They catch a lot, but they are probabilistic: a novel injection is a coin flip, and they add a model to your decision path.
Gateways and proxies (docker/mcp-gateway, agentgateway, IBM mcp-context-forge) route traffic, authenticate, and often rate-limit. Excellent plumbing. Their policy is usually a per-call allow or deny: this tool, this user, yes or no.
Aggrete is a proxy too, so it sits in the same spot as a gateway, but the policy is different in kind: deterministic, written as your code of conduct, and stateful. It reasons over the whole session, so it refuses the forbidden combination and the toxic flow, not just the single call. And it never puts a model in the decision.
| Static scanner | Model guardrail | Gateway / authz | Aggrete | |
|---|---|---|---|---|
| Runs at | install time | the edge (prompt/output) | each call | every call, in front of the upstream |
| Decides with | a catalog of known-bad | a model classifier | routing and authz rules | a deterministic policy rule |
| Stateful across calls | no | no | no | yes |
| Refuses forbidden combinations | no | partial | no | yes |
| Stops the lethal trifecta | partial | partial | no | yes |
| Tool integrity (poisoning, rug pull) | yes | no | partial | yes |
| Per-user identity to the upstream | no | no | partial | yes |
| Deterministic (same answer every time) | yes | no | partial | yes |
| Policy owned by non-engineers | no | no | no | yes |
Being honest is the point of a comparison. Aggrete is not a content classifier: if you want a model to judge toxicity or PII in free text, pair it with a guardrail. It is not a package-reputation database; a scanner's catalog of known-bad servers is complementary, and Aggrete happily runs behind or in front of one. And it is a policy layer, not a full API gateway: if you need advanced traffic shaping, run it alongside your gateway. The two compose, they do not compete.
Where Aggrete wins is the problem the others structurally cannot touch: the risk that only exists across several calls, decided by a rule you can read, owned by the person who wrote the policy, enforced before anything is fetched.
uvx aggrete --demo gives you a governed sandbox in one line.Aggrete is Apache-2.0 and runs on a laptop or a cluster. Star it, fork it, and tell us what rule to build next.