aggrete

Aggrete is an MCP (Model Context Protocol) proxy whose core function is to enforce a code-of-conduct document across connectors and, with the help of per-user memory accumulated across calls and sessions, judge whether a request is compliant. The problem it addresses is this: viewed in isolation, each individual tool call may not be sensitive, but several individually legitimate queries combined together can assemble a sensitive result (for example, piecing together a layoff list), and traditional per-server or per-call authorization mechanisms will not trigger any guardrail. Aggrete is precisely the layer used to intercept this kind of combination—judging whether "this call, plus everything this person has already pulled today, constitutes behavior prohibited by the code of conduct."

Main capabilities

• Refuse before upstream data fetching: use YAML policies and per-user memory across calls and sessions, rather than only doing single-call authorization. The provided example check tool can rehearse a plan and return a verdict before the data is actually fetched.
• Result redaction: redact email addresses, Social Security numbers (SSN), bank card numbers, and tokens before results reach the model; hide protected tools from users who are not authorized to call them.
• Prompt injection and tool poisoning protection: any write after the session has read untrusted content is denied; at the same time, hidden instructions in tool descriptions are flagged.
• Credential hosting: upstream credentials are held by the proxy itself (avoiding the confused deputy problem), and optionally support per-user on-behalf-of access.
• Tamper-proof auditing: every decision is recorded as a hash-chained JSON line (aggrete-audit), which can be forwarded to a SIEM or OpenTelemetry collector, and provides Prometheus metrics and health check endpoints.
• Modes of operation: check can preview any sequence, scenarios lists scenarios that can be tried; action: approve pauses a call until the terms owner approves from Slack, the terminal, or the console, and the approval is a time-limited, auditable authorization.
• Scanning: aggrete scan can harden existing MCP configurations, discover cross-server leakage paths, poisoned descriptions, secrets in configuration, servers that bypass the proxy, and provides a one-command fix (--fix).
• Compliance checks: aggrete conformance runs sixteen checks against real components and maps them to the OWASP MCP Top 10, OWASP Agentic Top 10,CoSAI and AIUC-1; --url can run the same scenarios in a black-box manner against any gateway.
• Adapter mode: the engine can run inside agentgateway (native ExtMCP via gRPC, aggrete extmcp), Docker MCP Gateway, IBM ContextForge, or any gateway that supports AuthZEN.

How to use You can try it via the online demo without installation; you can also run uvx aggrete --demo. First, you can run a scan (aggrete scan) to discover and fix issues in an existing MCP setup. Policies are written using the coc.yaml schema, support rule types and arg_match, and aggrete-ingest can be used to draft policies from your runbooks. For deployment, architecture descriptions, a deployment matrix, HTTP + OAuth, connecting Claude, and per-user credentials are provided. When building connectors, you can expose read/write tools and govern arbitrary systems (Google Drive is the reference implementation). Agent skills are also provided, which can teach Claude Code or any MCP client to install and operate Aggrete (/plugin marketplace add aggrete/aggrete, or read skill://aggrete/SKILL.md from a running agent).

Use cases MCP deployment environments that need unified governance across multiple connectors (such as Slack, Google Drive, GitHub, etc.), prevention of cross-system data combination leaks, protection against prompt injection and tool poisoning, and retention of auditable decision records.

Limitations

• Post-call denials can only redact, not "cancel the data fetch," so prefer rules that can be decided before the call.
• stdio identity is advisory; true enforcement requires streamable HTTP with OAuth, and blocking direct connector authorization at the IdP layer so that the proxy becomes the only path.
• Aggregation can only be narrowed, not completely solved: users may still bypass it if they stretch request intervals beyond the window, or rewrite across systems not covered by the proxy. It raises the cost and leaves an audit trail, but it is not an absolute ceiling.
• It is not a gateway and does not have multi-tenancy, token vaulting, or high availability. In production, it should be run behind agentgateway, Docker Gateway, or IBM ContextForge, which call it (adapter mode).