Assay Mcp Server
Policy-enforcing MCP proxy with portable evidence output.
- Transport
- Not stated
- Package
- —
- Registry id
- io.github.Rul1an/assay-mcp-server
No install snippet on purpose. A working MCP config is a command, its arguments and an environment block — the last two are where API keys live, so this catalogue never stores them and cannot publish them. Follow the link above for the authors' own instructions.
Quickstart · How it works · See it work · MCP example · OWASP MCP Top 10 · Discussions
Agents got real tool access through MCP — and tool poisoning, rug pulls, and confused-deputy OAuth came with it. Most tools scan a server or filter a prompt. Assay sits at the tool-call boundary and does three things, in order.
One golden path: the release-pinned agent journey records the nine driven CLI/MCP steps and their exit/stdout contracts. Its protected-action fixture lives in examples/privileged-action-gate/.
Enforce, prove, stay honest
- Enforce. A deterministic, fail-closed gate decides every
tools/callbefore it runs, with the precise reason for each allow or deny. On Linux it adds real kernel enforcement — an eBPF/LSM IPv4/TCP connect-egress block and a Landlock TCP-connect port allowlist, both opt-in and fail-closed. A policy it cannot express exactly is refused, never half-applied. - Prove. Each decision and observed effect becomes an offline-verifiable, tamper-evident evidence bundle: the verdict, the pre-call establish journey, and declared-vs-observed conformance — all reviewable in CI, with no hosted backend.
- Stay honest. Every claim carries its basis (
verified,self_reported,inferred,absent), and a gate refuses to let a claim exceed what was observed. A tool returning "success" is the provider's assertion, never proof. Assay ships no single safety score and never claims more than it can prove.
Quickstart
# Fast path: release installer for Linux and macOS.
curl -fsSL https://getassay.dev/install.sh | sh
# Confirm the command resolves; if setup fails, run `assay doctor`.
assay --version
# Source-build alternative (requires Rust):
cargo install assay-cli --version 6.5.0 --locked
python3 examples/mcp-quickstart/run.py
For v6.5.0, run the last command from a source checkout or an extracted published CLI archive.
The installer is binary-only and does not carry the bounded quickstart assets. The live
getassay.dev installer verifies the selected archive against its published SHA-256 sidecar before
extraction. Set ASSAY_REQUIRE_PROVENANCE=1 to additionally require GitHub artifact provenance;
the default reports provenance_not_requested and strict success reports provenance_verified.
A checksum proves byte equality with the published sidecar, not producer identity. Provenance
identifies the source and build, not runtime safety or semantic correctness.
Captured runner output (the bundled local mock performs no external action):
assay quickstart: PASS
mcp_requests=initialize,tools/list,tools/call
decision=allow tool=read_file
decision_artifact=.assay/quickstart/decisions.ndjson
non_claim=forwarded_to_local_mock_only
Released surfaces:
From the project's README.