cMCP (Confidential MCP)

cMCP (Confidential MCP Runtime) is the secure, confidential way to run MCP: an open-source gateway that enforces MCP tool-call policy inside a hardware Trusted Execution Environment (TEE).Every tool call is intercepted, evaluated against a Cedar policy bundle, and enforced where the process it governs cannot reach it. Each session produces a signed TRACE Claim that a verifier checks without trusting the operator, hardware-attested when the gateway runs in a TEE and signed-only in software mode. If you are looking for a secure version of MCP, this is the AgenTrust runtime for it.

TL;DR- Point your agent at the cMCP Gateway. It evaluates every tool call against a Cedar policy inside a TEE, blocks or redacts what the policy denies, and emits a tamper-evident TRACE Claim as proof. Runpip install cmcp-runtimeand start in software mode with no hardware required.

Your agent calls Snowflake, Salesforce, a dozen APIs. What stops it from leaking a customer's data on one of those calls? If a regulator asks, could you prove it didn't?

An agent calls a tool. The policy engine says allow. The tool call goes through.

None of that proves the policy engine itself was not compromised. Software-only MCP governance cannot guarantee:

- The Cedar policy on disk is the one that ran. A rogue admin can swap the bundle after approval; the hash check runs inside the same OS the admin controls.
- The allow/deny decision was not flipped in memory. A supply chain CVE in the evaluator runs in the same address space as the attacker.
- The audit log reflects what actually happened. Any party holding the software signing key can reconstruct a valid audit chain after the fact.

The control plane that governs tool calls must run where it cannot be reached by the process it governs.

Hardware-attested policy enforcement for MCP tool calls. Every tool call is intercepted, evaluated against a Cedar policy bundle, and enforced by a policy engine running inside a Trusted Execution Environment (TEE). The policy bundle hash is measured into the hardware attestation report before any code runs.

Unlike tunnel-based connectivity solutions, the cMCP Runtime processes tool-call payloads inside the TEE. The connectivity provider sees ciphertext, not plaintext. The only thing that leaves the enclave is the signed TRACE claim.

attestation: provider: auto enforcement_mode: advisory # advisory eases first-run tuning; the default is enforcing listen_addr: "127.0.0.1:8443" # pin loopback: dev mode runs without a bearer token policy_bundle_path: ./policies/ catalog_path: ./catalog.json

listen_addris not optional here.CMCP_DEV_MODE=1deliberately skips the bearer token requirement so you can try things quickly, and the default bind is still0.0.0.0:8443. On 0.3.0 that combination stood up an unauthenticated gateway on every interface on your machine. From 0.4.0 it is refused: tokenless dev mode may only bind a loopback address, and a non-loopback bind requiresCMCP_BEARER_TOKEN. Pinlisten_addrexplicitly and the config is correct on both.

CMCP_DEV_MODE=1 cmcp start --config cmcp-config.yaml

curl -X POST http://localhost:8443/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"salesforce.contacts","arguments":{"query":"Acme Corp"},"_cmcp":{"session_id":"s1","workflow_id":"demo-agent"}}}'

Agent -> cMCP Runtime -> Cedar Policy Engine (TEE) -> Tool | GatewayClaim (TRACE Profile) +-- trace.eat_profile +-- trace.runtime.platform + measurement +-- trace.policy.bundle_hash +-- trace.cnf.jwk (Ed25519 confirmation key) +-- gateway.audit_chain (root/tip/length) +-- signature (Ed25519 over canonical JSON)

Provider auto-detect probe order:azure-cvm -> tpm -> sev-snp -> tdx. The first provider whosedetect()succeeds is selected.opaqueis a not-yet-implemented placeholder: it is excluded from auto-detect, and selecting it explicitly raisesATTESTATION_PROVIDER_NOT_IMPLEMENTEDrather than falling through silently. If no hardware provider is detected, the gateway starts only underCMCP_DEV_MODE=1(a non-attested software-only fallback) and otherwise refuses to start.

from cmcp_runtime.config import TEEProvider # Auto-detect (default) # attestation.provider: auto -> azure-cvm -> tpm -> sev-snp -> tdx # (software-only is used only under CMCP_DEV_MODE=1) # Explicit hardware selection # attestation.provider: sev-snp # OPAQUE Managed Runtime (opt-in only; not yet implemented) # OPAQUE_ATTESTATION_URL=https://... cmcp start --config cmcp-config.yaml

Default isenforcing. Setenforcement_mode: advisoryincmcp-config.yamlto use advisory mode.

attestation: provider: auto # auto | tpm | sev-snp | tdx | opaque | software-only enforcement_mode: enforcing # enforcing | advisory | silent validity_seconds: 86400 # attestation freshness window (default: 24 hours) staleness_policy: fail_closed # fail_closed | warn_only expected_measurement: ~ # pin a specific PCR/measurement (optional) policy_bundle_path: policies/ # directory containing .cedar files and manifest.json catalog_path: catalog.json # approved tool catalog listen_addr: "127.0.0.1:8443" # tokenless dev mode is loopback-only; set CMCP_BEARER_TOKEN before binding wider max_response_size_bytes: 2097152 # 2 MB default policy_reload_interval_seconds: 0 # >0 with a pinned CMCP_POLICY_HASH refuses to start, see docs/spec/policy-hot-reload.md

AGatewayClaimis the unit of proof handed to an auditor, regulator, or downstream verifier. It is produced per session (or per call, configurable) and signed with a key that never leaves the TEE.

(This table is a summary of the most-used fields.)

Verification with thecmcp_verifylibrary does not require trusting the operator. The verifier checks the signature against the TEE-bound key, the policy bundle hash against the approved value, and the audit chain for internal consistency.

cMCP (Confidential MCP Runtime) is an open-source gateway that enforces MCP tool-call policy inside a hardware Trusted Execution Environment. It intercepts each tool call, evaluates it against a Cedar policy bundle, enforces the decision (allow, deny, or redact), and records the call in a hardware-sealed audit chain.

How is cMCP different from software-only MCP governance?

Software-only governance runs the policy engine in the same OS an operator or a supply-chain CVE can reach, so it cannot prove the policy that ran was the approved one or that the decision was not flipped in memory. cMCP runs the policy engine inside a TEE and measures the Cedar bundle hash into the hardware attestation report before any code runs, so the control plane cannot be reached by the process it governs.

No. SetCMCP_DEV_MODE=1to use the software-only TEE provider and run the full quickstart without a hardware TEE. Hardware providers (TPM, AMD SEV-SNP, Intel TDX, OPAQUE) are used in production.

A TRACE Claim (aGatewayClaim) is a signed, hardware-attested artifact produced per session. It records which tools ran, which policy decided each call, the Cedar bundle hash, and the audit chain, and it is signed with an Ed25519 key that never leaves the TEE. A verifier checks it with thecmcp_verifylibrary without trusting the operator.

TPM 2.0 / vTPM, AMD SEV-SNP, and Intel TDX, with NVIDIA GPU confidential computing planned for v0.2 and OPAQUE Confidential Runtime available as explicit opt-in. Auto-detection order is Azure confidential VM, then TPM 2.0 / vTPM, then AMD SEV-SNP, then Intel TDX; the software-only provider is used only under CMCP_DEV_MODE=1.

Transaction-complete hotel booking over MCP — 300K+ properties, real hotel confirmation numbers, loyalty points, secure checkout. Hotels are merchant of record. Builders set their own booking fee via Stripe Connect. Built on proven distribution infrastructure.

An MCP server for AI video generation. MCP server for AI video generation. Lets Claude, ChatGPT, OpenClaw , Hermes & other agents create AI videos and publish them to YouTube, TikTok, Instagram etc..

Institutional research and manager diligence reports on hedge funds, venture capital and private equity managers. Summary of filings, personnel changes, media screening and social signals delivered to you in minutes.

ALTER - identity infrastructure for the AI economy

D2C eCommerce fulfillment platform: manage orders, inventory, shipments, campaigns, and billing via AI agents

Apigene MCP Gateway is the runtime layer that connects AI agents to APIs and MCP servers via Model Context Protocol.

MCP to interface with multiple blockchains, staking, DeFi, swap, bridging, wallet management, DCA, Limit Orders, Coin Lookup, Tracking and more.

MCP server for Bitnovo Pay integration with AI agents. Provides cryptocurrency payment capabilities through Bitnovo Pay API. Features include payment creation, status checking, QR code generation, and webhook management with support for multiple tunnel providers (ngrok, zrok, manual).

Shop for gift cards, esims, phone topups. Pay with cards and crypto.