MCP Governance

Faramesh governs MCP at two layers: stdio wrapping for local MCP servers and HTTP proxying for networked MCP servers. In both paths, tools/call requests are policy-evaluated before they reach the upstream server.

MCP stdio wrapper

Wrap a local MCP server process and mediate JSON-RPC over stdin/stdout.

bash

faramesh mcp wrap \
  --policy policy.yaml \
  --agent-id claude-code \
  -- node your-mcp-server.js

The command after -- is the real MCP server executable. Faramesh proxies the protocol stream and enforces policy on tool calls.

MCP HTTP gateway

Run the daemon as an MCP HTTP gateway that forwards non-tool calls and governs tool execution.

bash

faramesh serve \
  --policy policy.yaml \
  --mcp-proxy-port 19092 \
  --mcp-target http://127.0.0.1:8080

Operational notes

Use the stdio wrapper when your IDE or local runtime launches an MCP child process. Use the HTTP gateway when your MCP server is remote or service-hosted.

MCP governance is implemented in-core with both wrapper and gateway paths. If policy denies a tools/call, the call does not reach the upstream MCP server.

Need help? Use any of these support options.

open an issue join slack community/forum

MIT License

docs github community get started →