keel-mcp-ingress

# Keel MCP ingress `keel-mcp-ingress` exposes operator-enrolled, schema-verified managed MCP tools over standard MCP stdio. It delegates every call to the Keel managed-MCP API. Listing a tool grants no authority. ## Prerequisites Use a Keel project with the required plan, active policies, and upstream MCP servers enrolled by the Keel operator. Server registration and discovery alone do not confer trust. Custom/unmapped servers are not exposed by this initial catalog. Initial catalog reads are bounded to 100 enabled servers and 1000 accepted tool contracts per project; larger catalogs return a clear refusal rather than silently dropping tools. Use managed MCP directly for larger catalogs. Starter cannot positively authorize arbitrary non-payment MCP calls. With no enrolled, verified servers, `tools/list` returns an empty catalog. Obtain a live agent-bound Client key: an owner creates an Admin key; the Admin creates an AgentPrincipal (`POST /v1/principals`) and a Client key bound to its `agent_principal_id` (`POST /v1/api-keys`). Keep the Admin/owner and upstream credentials outside the agent. An ordinary project Runtime/service key has no agent binding and cannot use this execution path. Upstream secrets stay in Keel. Because the requester is the agent, the project owner can approve its REVIEW requests; a request sent with a key the owner holds cannot be self-approved. ## Installation Requires Python 3.11 or newer. ```sh python3 -m venv .venv .venv/bin/python -m pip install keel-mcp-ingress==0.1.1 ``` Configure any MCP stdio client (including Claude-compatible clients): ```json { "mcpServers": { "keel": { "command": "/absolute/path/to/.venv/bin/keel-mcp", "env": { "KEEL_BASE_URL": "https://api.keelapi.com", "KEEL_API_KEY": "YOUR_AGENT_BOUND_CLIENT_KEY", "KEEL_PROJECT_ID": "YOUR_PROJECT_ID" } } } } ``` HTTPS is required; HTTP is accepted only for an isolated loopback runtime. Project identity is checked …