Protect MCP server

Read from the package source without running it. The installed server may list more.

• delete_filewrite action

  Delete a file from the filesystem

• deploywrite action

  Deploy the application to production

• evaluate_action

  Decide whether a proposed agent tool call is allowed by a Cedar policy, fail-closed. Evaluates the call against the policy the same way the protect-mcp gate does at runtime, and on any policy error the decision is DENY (never a silent allow). Inputs: tool (the tool name, e.g. "Bash" or "send_email"), input (the tool's arguments object; the policy sees it at context.input.*), and policy (inline Ced

• github_create_prwrite action

  Create a GitHub pull request

• pms_book_fill

  Book a fill into a mock PMS

• read_file

  Read the contents of a file

• self_test

  Prove the gate works, end to end, with no inputs. Runs a known-forbidden action (rm -rf) against a sample deny policy and asserts it is DENIED, then signs a decision and verifies the receipt round-trips. Returns JSON { ok: boolean, gate_denies_forbidden: boolean, sign_verify_roundtrip: boolean, details: object }. This is the 'a gate that cannot prove it denies does not start' check, exposed as a c

• send_emailwrite action

  Send an email

• sign_decision

  Turn a gate decision into an Ed25519 signed receipt (Veritas Acta format, JCS-canonical). A denial signs a gateway_restraint artifact; an allow signs a decision_receipt. This is what makes 'what the agent was blocked from doing' provable after the fact. Inputs: tool (required), decision ("allow" | "deny", required), reason_code (optional), policy_digest (optional), and private_key_hex (optional 64

• verify_receipt

  Verify a signed receipt offline against a public key. No network, no accounts: the Ed25519 signature is checked over the canonical bytes. Inputs: receipt (the signed artifact object, required) and public_key_hex (optional; falls back to a public_key embedded in the receipt payload). Returns JSON { valid: boolean, error: string | null (e.g. "invalid_signature", "no_public_key"), type: string, kid:

• web_search

  Search the web for information

• write_filewrite action

  Write content to a file

• Code scan53 source files scanned8/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 2 days ago15/15
• Maintainer identityregistry namespace matches repository owner7/10

Protect: common questions

Is Protect MCP server safe?

With care: it is graded C, so read the findings first (65/100). Read the Protect safety report

How do I install Protect?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Protect need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Protect maintained?

The last commit was 3 days ago (2026-09-17). The latest release is v0.13.1.

What can I use instead of Protect?

Servers from other publishers that do the same job: Ausca MCP server, MCP Server and AKShare MCP server. Compare all Protect alternatives.