{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_x4hvud46ss7z","handle":"mcp-zero-trust-layer","url":"https://wellknown.network/agents/mcp-zero-trust-layer","links":{"self":"https://wellknown.network/agents/mcp-zero-trust-layer/record.json","html":"https://wellknown.network/agents/mcp-zero-trust-layer","markdown":"https://wellknown.network/agents/mcp-zero-trust-layer/record.md","api":"https://wellknown.network/api/v1/agents/mcp-zero-trust-layer","status":"https://wellknown.network/api/v1/agents/mcp-zero-trust-layer/status","claim":"https://wellknown.network/agents/mcp-zero-trust-layer/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/mcp-zero-trust-layer/claim.json","badge":"https://wellknown.network/agents/mcp-zero-trust-layer/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/mcp-zero-trust-layer/history","tools":"https://wellknown.network/api/v1/agents/mcp-zero-trust-layer/tools"},"ard":{"identifier":"urn:air::server:mcp-zero-trust-layer","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"mcp-zero-trust-layer","summary":"Open-source, self-hosted Zero Trust policy enforcement layer for MCP servers.","description":"# MCP Zero Trust Layer\n\nMCP Zero Trust Layer, usually shortened to MCPZT, is an open-source and self-hosted security layer for MCP servers. It sits between an MCP client and one or more real MCP servers, then decides what the client can discover, call, send, receive, approve and audit.\n\nThe purpose is not to create a new MCP ecosystem or a hosted control plane. The purpose is to give developers and platform teams a practical enforcement point they can put in front of existing MCP servers without rewriting those servers.\n\n```text\nMCP client / agent\n  |\n  v\nMCP Zero Trust Layer\n  |\n  |  identity\n  |  policy\n  |  argument validators\n  |  human approvals\n  |  output enforcement\n  |  audit\n  v\nreal MCP server\n  |\n  v\ndatabase / repository / filesystem / CRM / payment API / internal system\n```\n\nThis README is the public practical entry point: what the project does, how to run it, how to configure it, and how to reason about common policy patterns. It intentionally avoids linking to internal planning material so the published package stays focused on usage, operations and security.\n\n## The Short Version\n\nAn MCP server can expose very powerful capabilities. A tool named `search_issues` may be harmless, while a tool named `merge_pull_request`, `delete_repository`, `run_sql`, `send_email`, `read_secret` or `create_refund` may have real operational impact. If a client can connect directly to the MCP server, the client may be able to list and call more tools than the user or organization intended.\n\nMCPZT adds a policy layer in front of that server. It can hide capabilities from `tools/list`, block calls before they reach the upstream, validate arguments, require human approval for high-risk actions, redact sensitive output, and write audit logs explaining every important decision.\n\nThe important design point is that MCPZT is not a SaaS requirement. It runs locally, in Docker, in CI, as an internal gateway, as a sidecar, or as a stdio wrapper around command-based MCP servers. C…","publisher":{"name":"MCP Zero Trust Layer Contributors","url":null},"homepage":"https://github.com/686f6c61/mcp-zero-trust-layer/tree/main/docs","repository":"https://github.com/686f6c61/mcp-zero-trust-layer/tree/main/docs","version":"0.6.0","license":null,"protocols":["mcp"],"tags":["mcp","security","zero-trust","policy","agents"],"pricing":null,"endpoints":[{"url":"pypi:mcp-zero-trust-layer","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"dev.version-control","name":"Version Control","confidence":1,"provenance":"derived"},{"slug":"dev.filesystem","name":"Filesystem","confidence":0.882,"provenance":"derived"},{"slug":"data.database","name":"Databases","confidence":0.768,"provenance":"derived"}],"categories":["data","dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"mcp-zero-trust-layer","registry":"pypi","observedAt":"2026-11-03T17:26:03.449Z","publishedAt":"2026-09-17T20:48:49.783353Z","latestVersion":"0.6.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"mcp-zero-trust-layer","url":"https://pypi.org/project/mcp-zero-trust-layer/","firstSeenAt":"2026-09-10T05:22:25.894Z","fetchedAt":"2026-11-03T17:24:49.426Z","normalizedAt":"2026-11-03T17:24:49.426Z"}]},"firstSeenAt":"2026-09-10T05:22:25.894Z","updatedAt":"2026-11-03T17:26:03.449Z"}