# aggrete [Health: Active]

**Category:** 🔗 Aggregators  
**Repository:** https://github.com/Aggrete/aggrete  
**GitHub Stars:** 2  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/aggrete

## Description
MCP policy proxy: enforces a code of conduct across connectors before the upstream is called.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "aggrete": {
    "command": "uvx",
    "args": ["aggrete"]
  }
}
```

## Documentation

## What the aggrete MCP server does

The aggrete MCP server sits between an MCP client and upstream connectors. It evaluates planned calls against a YAML code-of-conduct policy before data is fetched, allowing individually permitted requests to be rejected when their combination violates a rule. Per-user memory carries relevant activity across calls and sessions.

The proxy can redact emails, Social Security numbers, payment cards, and tokens from returned data. It can also hide tools that a user is not permitted to call. Write operations are refused after a session has read untrusted content, providing a defense against a documented prompt-injection path. Tool descriptions are checked for hidden instructions associated with tool poisoning.

Upstream credentials remain with the proxy, which is intended to reduce confused-deputy risk. Optional per-user on-behalf-of access is supported. Decisions are written as hash-chained JSON lines through `aggrete-audit`, and audit output can be forwarded to a SIEM or OpenTelemetry collector. Prometheus metrics and health endpoints are available for operations.

## How it works

The `check` tool previews a sequence and returns a verdict before execution. This makes it possible to test whether a planned set of connector calls will be accepted without fetching the underlying data. The `scenarios` capability provides cases to try during evaluation.

When a policy requires human review, an approval action pauses the call until the clause owner approves it. Approval can be handled through Slack, the terminal, or the console, and the resulting grant is time-limited and audited.

A post-call denial can redact a result, but it cannot undo the upstream fetch. Policies that can be decided before a call therefore provide stronger control. Aggregation detection is bounded by the configured window and by the systems that the proxy fronts; requests spaced beyond that window or made through ungoverned systems may not be connected.

## Setup and configuration

Install the package with `pip install aggrete` or install it as a tool with `uv tool install aggrete`. Running `uvx aggrete --demo` starts a walkthrough without configuration, authentication, or network access. A configured deployment can be started with `aggrete --config proxy.config.yaml`.

Policy configuration uses YAML. The project documentation describes the `coc.yaml` schema, rule types, and `arg_match`; `aggrete-ingest` can help draft policy from a handbook. The proxy can expose standard stdio or streamable HTTP operation. For dependable identity enforcement, use streamable HTTP with OAuth and prevent direct connector grants at the identity-provider layer.

The aggrete MCP server can also operate in adapter mode through agentgateway, Docker MCP Gateway, IBM ContextForge, or another AuthZEN-speaking gateway. The project describes this mode as appropriate when a production gateway is needed.

## Tools and capabilities

- Preview a planned call sequence with `check`.
- Explore test cases with `scenarios`.
- Enforce policy across connector calls and accumulated user activity.
- Redact selected sensitive values from results.
- Hide inaccessible tools from users.
- Require audited, time-limited human approval for selected actions.
- Emit hash-chained audit records, metrics, and health information.
- Run conformance checks against real components or a gateway URL.

## Limitations and notes

The aggrete MCP server is not a full gateway: it does not provide multi-tenancy, a token vault, or high availability. The project recommends placing it behind agentgateway, Docker's gateway, or IBM ContextForge for production deployments.

Stdio identity is advisory rather than a strong enforcement boundary. HTTP with OAuth is the documented option when the proxy must be the only route to connectors. Aggregation controls reduce exposure and create an audit trail, but they cannot guarantee detection when a user changes timing, paraphrases requests, or accesses systems outside the proxy's coverage.

_Full upstream README: https://allmcps.com/mcp/aggrete/readme_