io.github.aggrete/aggrete

Aggrete

An MCP proxy that enforces a code-of-conduct document across connectors, with per-user memory that accumulates across calls.

Four individually-authorized questions can assemble a layoff list — no single one is sensitive, so no guardrail fires. Aggrete is the layer that catches the combination: is this call, together with everything this person already pulled today, something the code of conduct forbids?

Try it live — nothing to install · or uvx aggrete --demo

Start with a scan

pip install aggrete && aggrete scan

Finds every MCP server your clients use, connects to each, and prints what no per-server scanner does: tool combinations across servers that form a leak path, hidden instructions in descriptions, secrets in client configs, servers that bypass the proxy. --fix writes the config and policy that close them. Details.

Install

pip install aggrete                 # or: uv tool install aggrete
uvx aggrete --demo                  # the walkthrough — no config, auth, or network
aggrete --config proxy.config.yaml  # run it for real

The one example

The check tool dry-runs a plan and returns the verdict before anything is fetched:

Plan check: REFUSED.
  1. hr__recent_joiners     [hr-personnel]  ->  allowed
  2. finance__budget_roles  [finance-comp]  ->  allowed
  3. ops__oncall_draft      [ops-rota]      ->  REFUSED   COC-HR-004
     Personnel, compensation, and operational rosters may not be combined to
     derive the planned departure of identifiable individuals.

Each call is fine alone. The third completes a forbidden set across three domains that overlap on the same people, so it's denied before the upstream call — the data is never fetched.

What it does

• Refuses before fetching, using a YAML policy and per-user memory across calls and sessions — not single-call authorization.
• Redacts emails, SSNs, cards, and tokens from results before they reach the model; hides walled tools from users who can't call them.
• Shields against prompt injection — any write after a session reads untrusted content is refused — and against tool poisoning, flagging hidden instructions in tool descriptions.
• Holds upstream credentials itself (confused-deputy safe), with optional per-user on-behalf-of access.
• Audits tamper-evidently — every decision is one hash-chained JSON line (aggrete-audit), forwarded to a SIEM or an OpenTelemetry collector, with Prometheus metrics and health endpoints for operations.
• Ask before you act — check previews any sequence, scenarios lists things to try.
• Hold for a human — action: approve pauses a call until the clause owner approves it, from Slack, the terminal, or the console; the approval is a time-limited, audited grant.

Learn more

• Writing policy — the coc.yaml schema, rule types, arg_match, and drafting from your handbook with aggrete-ingest
• Deploying — architecture, the deploy matrix, HTTP + OAuth, connecting Claude, and per-user credentials
• Building a connector — expose read/write tools and govern any system (Google Drive is the reference)
• Adapter mode — run the engine inside agentgateway (native ExtMCP over gRPC, aggrete extmcp), Docker MCP Gateway, IBM ContextForge or any AuthZEN-speaking gateway
• What it does not stop — supply chain, host execution, client bugs, memory poisoning: where a proxy is the wrong control and what is
• Scanning — aggrete scan hardens an existing MCP setup: cross-server leak paths, poisoned descriptions, secrets in configs, proxy bypasses, and a one-command fix
• Conformance — aggrete conformance runs sixteen checks against the real components and maps them onto the OWASP MCP Top 10, OWASP Agentic Top 10, CoSAI and AIUC-1; --url runs the same scenarios black-box against any gateway (latest report)
• Roadmap — shipped, in progress, and planned
• Agent skill — teach Claude Code or any MCP client to set up and operate Aggrete: /plugin marketplace add aggrete/aggrete, or read skill://aggrete/SKILL.md from a running proxy

Honest limitations

• Post-call denial redacts, it does not un-fetch — prefer rules decidable pre-call.
• stdio identity is advisory — real enforcement needs streamable HTTP with OAuth and IdP-level blocking of direct connector grants, so the proxy is the only path.
• Aggregation can only be narrowed, not solved — a user who spaces requests beyond the window, or paraphrases across systems the proxy doesn't front, gets through. This raises the cost and creates the audit trail; it isn't a ceiling.
• Not a gateway — no multi-tenancy, token vault, or HA. For production, run it behind agentgateway, Docker's gateway or IBM ContextForge and let them call it (adapter mode).

mcp-name: io.github.aggrete/aggrete