# Cordon [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/marras0914/cordon  
**GitHub Stars:** 2  
**npm Downloads (last month):** 175  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/cordon

## Description
Security gateway for MCP. Policy enforcement, audit logging, human-in-the-loop approvals.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "cordon": {
    "command": "npx",
    "args": ["-y","@getcordon/cli"]
  }
}
```

## Documentation

## What Cordon does

Cordon MCP server controls how an AI agent reaches MCP tools. It sits between the agent and one or more MCP servers, which may provide access to databases, filesystems, APIs, or cloud infrastructure. Each intercepted call receives a policy decision before it is passed through or rejected.

The gateway separates read and write access, supports rules at server and tool scope, and records the request, decision, result, and timing for each call. It can also require a person to approve selected operations instead of allowing an agent to perform them automatically.

## How it works

Cordon MCP server runs as a gateway in front of configured MCP servers. Its configuration identifies each server, transport, command, arguments, and default policy. Tool-specific rules can override the server default.

Supported policy behaviors described in the configuration include allowing a call, blocking it, logging it without interruption, or requiring approval. The `read-only` policy blocks tools identified as write operations. With `approve-writes`, reads pass automatically while writes wait for a decision.

Approval requests can appear in the terminal or in Slack. A pending call pauses while the approver chooses approve or deny. If the request times out, it is denied but retained with its context. A late-approved request can be replayed with the CLI; replay runs the tool call, not the original agent session.

## Setup and configuration

Run `npx @getcordon/cli init` from the project containing `claude_desktop_config.json`. The initializer reads that file, creates `cordon.config.ts`, and updates Claude Desktop so calls pass through Cordon. Start the gateway with `npx @getcordon/cli start`, then restart Claude Desktop.

Manual setup is also available through `npm install -g @getcordon/cli`, followed by `cordon init`. The generated TypeScript configuration defines servers, transports, commands, policies, audit output, approval channels, and approval timeouts. Audit output can go to standard output or a file.

## Tools and capabilities

Cordon MCP server provides gateway controls rather than application-specific MCP tools. Its documented capabilities include:

- Per-server, per-tool, and global policy rules.
- Read-only protection for a configured server.
- Hidden tools that are removed from the client's `tools/list` response.
- Structured JSON audit events for received, approved, completed, and other call states.
- Terminal or Slack approval workflows.
- SQL-aware read-only and approve-writes policies for database tools.
- Replay of calls approved after an approval timeout.

SQL-aware policies parse the SQL statement instead of relying only on the MCP tool name. They use the PostgreSQL dialect by default and fail closed when SQL cannot be parsed.

## Limitations and notes

Cordon does not replace the underlying MCP servers; it governs calls made through the configured gateway. The documented quickstart targets Claude Desktop. SQL-aware policies currently use the PostgreSQL dialect, with other dialects described as future work. A replay recovers only the timed-out tool call, so it does not restore the agent's prior conversation or session. A call that already ran must not be replayed because it could execute twice.

_Full upstream README: https://allmcps.com/mcp/cordon/readme_