Open-source, self-hosted Zero Trust policy enforcement layer for MCP servers.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-zero-trust-layer","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# MCP Zero Trust Layer MCP Zero Trust Layer, usually shortened to MCPZT, is an open-source and self-hosted security layer for MCP servers. It sits between an MCP client and one or more real MCP servers, then decides what the client can discover, call, send, receive, approve and audit. The purpose is not to create a new MCP ecosystem or a hosted control plane. The purpose is to give developers and platform teams a practical enforcement point they can put in front of existing MCP servers without rewriting those servers. ```text MCP client / agent | v MCP Zero Trust Layer | | identity | policy | argument validators | human approvals | output enforcement | audit v real MCP server | v database / repository / filesystem / CRM / payment API / internal system ``` This README is the public practical entry point: what the project does, how to run it, how to configure it, and how to reason about common policy patterns. It intentionally avoids linking to internal planning material so the published package stays focused on usage, operations and security. ## The Short Version An MCP server can expose very powerful capabilities. A tool named `search_issues` may be harmless, while a tool named `merge_pull_request`, `delete_repository`, `run_sql`, `send_email`, `read_secret` or `create_refund` may have real operational impact. If a client can connect directly to the MCP server, the client may be able to list and call more tools than the user or organization intended. MCPZT adds a policy layer in front of that server. It can hide capabilities from `tools/list`, block calls before they reach the upstream, validate arguments, require human approval for high-risk actions, redact sensitive output, and write audit logs explaining every important decision. The important design point is that MCPZT is not a SaaS requirement. It runs locally, in Docker, in CI, as an internal gateway, as a sidecar, or as a stdio wrapper around command-based MCP servers. C…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.