Skip to content
deedglassdocs

Govern an MCP server

Every tools/call to the server goes to the Gate first: the policy decides, the call runs only if allowed, and a deed records the result.

Before you start

  • A Deedglass server, an agent key (DEEDGLASS_API_KEY) and its address (DEEDGLASS_SERVER).
  • The MCP server you want to govern.

Two ways in

Section titled “Two ways in”
stdio wrap HTTP gateway
Where the server runs On the agent’s machine, started by the client Anywhere Deedglass can reach over HTTP
Command deedglass mcp wrap --connector <name> -- <cmd> a mcp_http connector, served at /mcp/<name>
Who holds the server’s credential The process on the agent’s machine The vault, on the Deedglass server
Mode proxy: the call runs at the edge, Deedglass decides and records gateway: Deedglass runs the call

1. Wrap a stdio server

Section titled “1. Wrap a stdio server”
Terminal window
deedglass mcp wrap --connector files -- npx -y @modelcontextprotocol/server-filesystem@2026.8.31 /tmp/deedglass-demo

The wrapper relays everything else untouched. It hides tools the policy always denies (--hide-denied, on by default), so the model doesn’t keep trying them. If the server is unreachable, the call fails closed.

2. Or put a remote server behind the gateway

Section titled “2. Or put a remote server behind the gateway”

Create an mcp_http connector. Its credential goes into the vault and never reaches the agent:

everything.yaml
type: mcp_http
name: everything
config:
  url: https://mcp.example.com/mcp
  auth: { kind: bearer }
  timeout_ms: 30000
Terminal window
deedglass connector create --config everything.yaml
deedglass connector credentials set everything --from-env EVERYTHING_TOKEN

Clients then connect to http://127.0.0.1:8080/mcp/everything with their agent key. Upstream tools have the side effect unknown, so write a policy rule for each tool you allow.

3. Watch the calls

Section titled “3. Watch the calls”
Terminal
$ deedglass actions list --limit 5
…

deedglass actions list --follow --connector files streams them as they are decided.

What it doesn’t do

Section titled “What it doesn’t do”
  • MCP results are the server’s own words: the Witness records them at L0 (Reported). Only connectors that can read the target back reach L1 or L2.
  • A wrapped server still runs with its own access on the agent’s machine. The wrap governs the calls an agent makes through MCP, not the process itself.
  • Tool descriptions that carry instructions aren’t rewritten. Upstream tool names that aren’t plain ASCII are hidden.

Next

Section titled “Next”