policy-engine

Open-source security scanner and firewall for MCP servers. It scans configs for common MCP risks, enforces runtime policies on tool calls, and produces audit logs, with CLI commands, policy examples, and a programmatic API.

Attestor is a TypeScript control plane for high-risk AI-driven operations. It sits between an AI-generated request and the real system action, applying policy, approval, scope, freshness, replay, and evidence checks before returning admit, narrow, review, or block.