evav-gateway

The open-source governed MCP gateway. Point any AI agent (Claude, Cursor, ChatGPT, your own) at one endpoint; every tool call it makes is governed — policy-checked, screened for prompt-injection/exfiltration, haltable by a kill-switch — and written to a signed, tamper-evident audit log before it reaches the real tool.

Built on FastMCP for the wire (federation, pooled sessions, auth, transport); the governance layer is ours.

Status: v0.1, early. The governed proxy + signed audit + injection screening work and are tested. OAuth brokering, an OPA policy backend, the one-command client-setup, and packaging are on the roadmap below.

Why

Every OSS MCP gateway governs the wire. Most log unsigned, have no native injection screening, and no approval gate. evav-gateway:

• Signs its audit log (Ed25519, hash-chained) — tamper-evident. No surveyed gateway does this.
• Screens every call for prompt-injection / exfiltration on the way in and the way out — native, not a bolt-on.
• Fails closed: a policy error, an injected argument, a poisoned upstream output, or an engaged kill-switch stops the call. It never silently allows.

Governance pipeline (per tool call)

kill-switch → policy (block / require-approval) → injection screen (input)
  → forward to upstream (pooled session) → injection screen (output, withhold)
  → signed audit record

Use as a library

from fastmcp import Client
from evav_gateway import build_gateway, Policy

gw, audit = build_gateway(
    {"mcpServers": {"slack": {"url": "https://mcp.slack.com/mcp"}}},
    policy=Policy(approval_tools=("payments.transfer",),
                  block_patterns=(r"\bssn\b",)),
)
# every call through `gw` is governed; audit.verify() checks the signed chain

Config-as-code

# evav-gateway.yaml
name: "Acme Gateway"
injection_on: true
upstreams:
  - name: slack
    url: https://mcp.slack.com/mcp
    auth_env: SLACK_MCP_TOKEN        # secret from env, never inlined
policy:
  approval_tools: [payments.transfer]
  block_patterns: ["\\bssn\\b", "password"]
  param_limits:
    payments.transfer: { amount: 1000 }

evav-gateway run --config evav-gateway.yaml

Quickstart

pip install evav-gateway          # or: uvx evav-gateway ...
cp evav-gateway.example.yaml evav-gateway.yaml     # edit upstreams + policy
evav-gateway run --config evav-gateway.yaml        # serves http://127.0.0.1:8000/mcp
evav-gateway client-setup --client cursor --url http://127.0.0.1:8000/mcp   # point your agent here

Or with Docker:

docker build -t evav-gateway .
docker run -p 8000:8000 -v "$PWD/evav-gateway.yaml:/config/evav-gateway.yaml" evav-gateway

Roadmap

• [x] Governed proxy on FastMCP (policy · injection in/out · kill-switch · signed audit)
• [x] evav-gateway client-setup — one command to point Claude/Cursor/VS Code/Windsurf here
• [x] Docker image + uvx/pip install
• [x] OPA (Rego) policy backend for enterprise param/context authz (opt-in; see examples/policy.rego)
• [x] Brain-injection: inject the org's rules/skills into any agent (evav_rules / evav_skill)
• [x] Persistent signed audit (SQLite + stable key) — retrieve via evav_audit, verify offline via evav-gateway verify-audit
• [x] Hardened injection screen (decode pass: base64/URL/control-char obfuscation)
• [ ] OAuth 2.1 + upstream token brokering (agents never hold upstream creds)
• [ ] Shared multi-replica audit (Postgres + shared key)
• [ ] Async endpoint + tuned connection pooling under load
• [ ] Rule/skill/memory context injection (inject the org's relevant rules into any agent)
• [ ] Helm chart

License

Apache-2.0.