# ARKALDA/hejdar-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/ARKALDA/hejdar-mcp  
**GitHub Stars:** 1  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/arkalda-hejdar-mcp

## Description
Runtime policy enforcement for AI agents. Evaluate actions against organization policies before execution, with observe and enforce modes.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "hejdar-mcp": {
    "command": "uvx",
    "args": ["hejdar-mcp"],
    "env": {
      "HEJDAR_API_KEY": "",
      "HEJDAR_API_URL": ""
    }
  }
}
```

**Requires environment variables:** `HEJDAR_API_KEY`, `HEJDAR_API_URL` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What ARKALDA/hejdar-mcp MCP server does

ARKALDA/hejdar-mcp MCP server adds a policy check to an agent's workflow. It exposes one MCP tool, `hejdar_evaluate`, which evaluates a proposed action before the agent performs it. The server supports action types for `READ`, `WRITE`, `DELETE`, `TRANSFER`, and `EXECUTE`.

Each request identifies the target resource and can optionally include the calling agent's name and free-form context such as a department, user ID, or reason. The response contains a decision, and may include the policy identifier, an explanation, and a risk level. Decisions are returned as `ALLOW`, `DENY`, or `WOULD_DENY`.

The server does not contain or interpret the organization's policy rules. Those rules are configured in Hejdar, and the Hejdar API supplies the evaluation result.

## How it works

ARKALDA/hejdar-mcp MCP server acts as a thin MCP-to-HTTP adapter. An MCP-compatible client invokes `hejdar_evaluate`; the server validates and sanitizes the supplied values, then sends the request to Hejdar's `POST /v1/evaluate` endpoint. The API response is returned to the agent through MCP.

A system prompt can instruct an agent to call the tool before any action involving external systems. The documented pattern also tells the agent not to continue when the result is `DENY` or `WOULD_DENY`, and to provide the returned reason to the user.

The API key is read from the environment rather than from tool input. The project states that API calls use TLS and that error responses do not expose API keys, stack traces, or internal details.

## Setup and configuration

Install the package with `pip install hejdar-mcp`, or run it without a separate installation using `uvx hejdar-mcp`. The server needs a Hejdar API key, created through the Hejdar application or obtained from Hejdar. Set it in `HEJDAR_API_KEY` before starting the process.

For Claude Desktop or Claude Code, configure a server entry that runs `uvx` with `hejdar-mcp` as its argument and passes the key through the environment. A direct stdio launch is also supported with the same environment variable.

`HEJDAR_API_URL` is optional and defaults to `https://api.hejdar.com`. Set it when connecting to a self-hosted Hejdar API. The README includes a Claude Desktop configuration example; it does not provide client-specific configuration for every MCP-compatible client.

## Tools and capabilities

The single exposed tool is `hejdar_evaluate`. Its required inputs are:

- `action_type`: `READ`, `WRITE`, `DELETE`, `TRANSFER`, or `EXECUTE`
- `resource`: the target resource

Optional inputs are `agent_name` and a free-form `context` object. Results can identify the matching policy, explain the decision, and report a risk level when supplied by the API.

ARKALDA/hejdar-mcp MCP server is suited to agents that need an explicit authorization or policy check before operating on organizational resources. It does not itself execute the approved action.

## Limitations and notes

The server only evaluates requests; it does not perform reads, writes, deletions, transfers, or command execution. Its decisions depend on the policies configured in the connected Hejdar organization, so the repository alone does not define which actions will be allowed.

A valid Hejdar API key is required to use the service. The material does not specify Hejdar's pricing or whether an API key requires a paid plan. The repository is licensed under MIT.

_Full upstream README: https://allmcps.com/mcp/arkalda-hejdar-mcp/readme_