{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_ytm9h2kzp6pm","handle":"pontifex-mcp","url":"https://wellknown.network/agents/pontifex-mcp","links":{"self":"https://wellknown.network/agents/pontifex-mcp/record.json","html":"https://wellknown.network/agents/pontifex-mcp","markdown":"https://wellknown.network/agents/pontifex-mcp/record.md","api":"https://wellknown.network/api/v1/agents/pontifex-mcp","status":"https://wellknown.network/api/v1/agents/pontifex-mcp/status","claim":"https://wellknown.network/agents/pontifex-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/pontifex-mcp/claim.json","badge":"https://wellknown.network/agents/pontifex-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air::server:pontifex-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"pontifex-mcp","summary":"The security, access-control, and governance layer for MCP servers.","description":"# pontifex-mcp\n\nThe security and governance layer for MCP servers, built on the official [MCP Python SDK](https://github.com/modelcontextprotocol/python-sdk).\n\n`pontifex-mcp` lets you build [MCP](https://modelcontextprotocol.io) servers that connect AI agents to\nreal systems without giving up control over who can call what. You write the tools; it handles\nauthentication, per-caller scopes, rate limits, and a full audit trail.\n\n## Key features\n\n- **Secure by default** — OAuth 2.1 JWTs *and* `sk_…` API keys; every tool call is authenticated.\n  Any OIDC provider (Auth0, Entra, Clerk, Keycloak).\n- **Least-privilege scopes** — `namespace:resource:action`, checked before every call. Callers can't\n  widen their own access.\n- **Auditable** — every call recorded: who, what, when, data source, cache hit, latency.\n- **Standards-based** — RFC 9728 discovery + `WWW-Authenticate`; MCP clients bootstrap auth on their own.\n- **Resilient** — per-caller rate limiting, adapter failover, circuit breaking.\n- **Observable** — Logfire / OpenTelemetry tracing and metrics wired in.\n- **Drop-in connectors** — generate governed tools from an OpenAPI spec (code or config), with optional\n  per-user OAuth token exchange (RFC 8693) to the downstream.\n- **Built on the MCP SDK** — keep its tools, protocol, and transports; add the controls a production\n  server needs.\n- **Coding-agent friendly** — bundles an official agent skill (`uvx library-skills`) so your coding\n  agent builds on guidance that matches your installed version.\n\nAsymmetric-only JWT validation, generic auth errors, and no token claim can escalate a caller.\n\n## Install\n\n```bash\npip install pontifex-mcp     # or: uv add pontifex-mcp\n```\n\nRequires Python 3.12+. The floor below needs nothing else; Postgres and Redis come in only\nwhen you turn on API-key auth.\n\n## Start in a few lines\n\n`PontifexMCP` is a drop-in subclass of the MCP SDK's `FastMCP`. The floor needs no database,\nno Redis, and no auth — the caller is anonymous and every ca…","publisher":{"name":"Chris Dare","url":null},"homepage":"https://argonauts.chrisdare.me","repository":"https://github.com/chris-dare/pontifex/issues","version":"0.5.1","license":null,"protocols":["mcp"],"tags":["mcp","model-context-protocol","ai","agents","oauth","enterprise"],"pricing":null,"endpoints":[{"url":"pypi:pontifex-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"security.identity","name":"Identity & Access","confidence":1,"provenance":"declared"},{"slug":"data.database","name":"Databases","confidence":0.825,"provenance":"derived"}],"categories":["data","security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"pontifex-mcp","registry":"pypi","observedAt":"2026-09-10T10:25:29.801Z","publishedAt":"2026-06-23T21:45:42.764589Z","latestVersion":"0.5.1"}},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"pontifex-mcp","url":"https://pypi.org/project/pontifex-mcp/","firstSeenAt":"2026-09-10T10:23:31.171Z","fetchedAt":"2026-09-10T10:23:31.171Z","normalizedAt":"2026-09-10T10:23:31.171Z"}]},"firstSeenAt":"2026-09-10T10:23:31.171Z","updatedAt":"2026-09-10T10:25:29.801Z"}