Fail-closed Cedar policy gate + Ed25519 signed receipts for AI agent tool calls. Denies on any policy error, proves the gate is live with a startup
Most developer tooling work still happens through a UI a human drives. Scopeblind Gateway MCP server moves it into the conversation instead. Fail-closed Cedar policy gate + Ed25519 signed receipts for AI agent tool calls. Denies on any policy error, proves the gate is live with a startup self-test, and turns every decision into a local searchable record you own. The open gate.
The server publishes 14 tools. What each one is for:
serve — Start the HTTP hook server for Claude Code (port 9377). --enforce runs the restraint self-test first; --cedar and --policy select theinit — Generate an Ed25519 keypair (keys/gateway.json), a config template, and a sample policysample — Seed a clearly-labeled sample record (8 decisions: one blocked call, two payments; kid sample-demo) plus a tampered copy, so record, claimpolicy — See and change the Cedar policy from the terminal: policy list (permit / forbid / default-deny per tool, with how often the gate allowed or deniedwrap — Print a protected MCP command or patch Claude Desktop MCP servers. Dry-run by default; use --write to update Claude Desktop configdashboard — Start a local-only dashboard on 127.0.0.1 showing tool inventory, risk, policy coverage, exact-action approvals, receipt chains, and audit exportrecommend — Draft a reviewable JSON policy from observed local calls. Dry-run by default; use --write to create protect-mcp.recommended.jsonregistry — Create an org identity, anchor receipt digests, and write a static verifier page. Hosted mode uploads digests onlyrecord — Open a local, searchable viewer over your receipts (--live streams as the agent runs): Ed25519 signatures verified in your browser against yourclaim — Mint a signed, position-blind attestation of a predicate over the record (--no incl. --no payment, --only <c1,c2>, --no-verdict anchor-record — Checkpoint the record's Merkle root + count + time range into the public log (heartbeat-friendly: skips when unchanged). A later claim whoseverify-claim — Verify a claim pack offline: signature, recomputed Merkle root, independently recomputed predicate, and the anchor sidecar when present (binds theConfiguration is passed through the environment: SCOPEBLIND_TOKEN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Because this one is hosted, setup is mostly authentication — you point your client at the endpoint and approve access. Nothing runs on your machine, so there is no runtime to keep patched.
Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Scopeblind Gateway's toolset — serve, init, sample and 11 more — is a fair guide to whether it matches your workflow. It is maintained by scopeblind; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| serve | Start the HTTP hook server for Claude Code (port 9377). --enforce runs the restraint self-test first; --cedar <dir> and --policy <path> select the policy. |
| init | Generate an Ed25519 keypair (keys/gateway.json), a config template, and a sample policy. |
| sample | Seed a clearly-labeled sample record (8 decisions: one blocked call, two payments; kid sample-demo) plus a tampered copy, so record, claim, verify-claim, and anchor-record are replayable from scratch before wiring an age |
| policy | See and change the Cedar policy from the terminal: policy list (permit / forbid / default-deny per tool, with how often the gate allowed or denied it), policy show, policy allow <tool>, policy deny <tool>, policy path. A |
| wrap | Print a protected MCP command or patch Claude Desktop MCP servers. Dry-run by default; use --write to update Claude Desktop config. |
| dashboard | Start a local-only dashboard on 127.0.0.1 showing tool inventory, risk, policy coverage, exact-action approvals, receipt chains, and audit export. |
| recommend | Draft a reviewable JSON policy from observed local calls. Dry-run by default; use --write to create protect-mcp.recommended.json. |
| registry | Create an org identity, anchor receipt digests, and write a static verifier page. Hosted mode uploads digests only. |
| record | Open a local, searchable viewer over your receipts (--live streams as the agent runs): Ed25519 signatures verified in your browser against your gateway key, capability tags, a provenance tree, and one-click signed export |
| claim | Mint a signed, position-blind attestation of a predicate over the record (--no <cap> incl. --no payment, --only <c1,c2>, --no-verdict <verdict>, --count <verdict>, --payment-under <cap>), disclosing only decision categor |
| anchor-record | Checkpoint the record's Merkle root + count + time range into the public log (heartbeat-friendly: skips when unchanged). A later claim whose commitment matches an anchored checkpoint is provably over the complete record |
| verify-claim | Verify a claim pack offline: signature, recomputed Merkle root, independently recomputed predicate, and the anchor sidecar when present (binds the anchored envelope to this exact claim, then confirms the public log holds |
| killer-demo | Generate a complete shadow-mode to policy to approval to signed-receipt demo pack. |
| verify-disclosure | Verify a scopeblind.selective_disclosure.v0 package and explain disclosed versus hidden fields. |
{
"mcpServers": {
"scopeblind-gateway": {
"command": "npx",
"args": ["-y", "protect-mcp"],
"env": {
"SCOPEBLIND_TOKEN": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| SCOPEBLIND_TOKEN | Credential the server authenticates with. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.