An MCP proxy where the backend is only contacted after release

MCP made tool access easy for agents, which also made it easy to bypass governance. I needed the same decision path for MCP calls as for library calls.

kognita serve --mcp fronts one or more MCP servers from a root config naming the backends, the policy pack, the evidence database and the default actor. Every tools/call and tools/list is authorised with run_governed() before it is proxied. Initialize and ping are answered locally.

Identity rules are shared with the AI gateway. A call with no agent name is denied and is not treated as a human. An agent name is admitted only when the bound client configuration lists it. Evidence stores a hash and size of the tool arguments, not the arguments. If the evidence store cannot record the call, the proxy refuses it.

Notifications and unimplemented methods are simply not forwarded. That is safe, but it limits which MCP features work through the proxy in this alpha.

A denial, an escalation and an ungranted approval should all look the same to the backend: silence. Only a release reaches it.

Sources

Kognita is an open-source alpha. This note comes from Kognita PR #13 in the Kognita repository.