Log inSubmit server
Aggrete logo

Aggrete

Enforces YAML policies across MCP connectors, tracking user activity, redacting results, and blocking unsafe calls before upstream access.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Aggrete

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "aggrete": {
      "command": "uvx",
      "args": [
        "aggrete"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

uvx aggrete

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked Today.

Overview

The aggrete MCP server proxies connector calls and applies a code-of-conduct policy before upstream systems are contacted. It keeps per-user memory across calls and sessions, so rules can evaluate combinations of requests rather than isolated actions. Use it when agents need policy enforcement, sensitive-data redaction, prompt-injection defenses, approval workflows, and tamper-evident auditing across multiple connectors. It can run locally with stdio or over streamable HTTP, with HTTP deployment recommended when identity enforcement must be reliable.

Use cases

  • Block multi-step data combinations that violate a code-of-conduct policy
  • Redact sensitive values before connector results reach an agent
  • Preview and audit planned connector calls
  • Require human approval for selected write actions

Key features

  • YAML policy enforcement before upstream calls
  • Per-user memory across calls and sessions
  • Sensitive-data redaction and tool visibility controls
  • Prompt-injection and tool-poisoning defenses
  • Human approval workflows with audited grants
  • Hash-chained audit logs, metrics, and health endpoints

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

6/6 checks healthy over the last 46d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 3h ago via OSV.dev · aggrete (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars2Stargazers on the source repository.
Last commit7d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Aggrete works

What the aggrete MCP server does

The aggrete MCP server sits between an MCP client and upstream connectors. It evaluates planned calls against a YAML code-of-conduct policy before data is fetched, allowing individually permitted requests to be rejected when their combination violates a rule. Per-user memory carries relevant activity across calls and sessions.

The proxy can redact emails, Social Security numbers, payment cards, and tokens from returned data. It can also hide tools that a user is not permitted to call. Write operations are refused after a session has read untrusted content, providing a defense against a documented prompt-injection path. Tool descriptions are checked for hidden instructions associated with tool poisoning.

Upstream credentials remain with the proxy, which is intended to reduce confused-deputy risk. Optional per-user on-behalf-of access is supported. Decisions are written as hash-chained JSON lines through aggrete-audit, and audit output can be forwarded to a SIEM or OpenTelemetry collector. Prometheus metrics and health endpoints are available for operations.

How it works

The check tool previews a sequence and returns a verdict before execution. This makes it possible to test whether a planned set of connector calls will be accepted without fetching the underlying data. The scenarios capability provides cases to try during evaluation.

When a policy requires human review, an approval action pauses the call until the clause owner approves it. Approval can be handled through Slack, the terminal, or the console, and the resulting grant is time-limited and audited.

A post-call denial can redact a result, but it cannot undo the upstream fetch. Policies that can be decided before a call therefore provide stronger control. Aggregation detection is bounded by the configured window and by the systems that the proxy fronts; requests spaced beyond that window or made through ungoverned systems may not be connected.

Setup and configuration

Install the package with pip install aggrete or install it as a tool with uv tool install aggrete. Running uvx aggrete --demo starts a walkthrough without configuration, authentication, or network access. A configured deployment can be started with aggrete --config proxy.config.yaml.

Policy configuration uses YAML. The project documentation describes the coc.yaml schema, rule types, and arg_match; aggrete-ingest can help draft policy from a handbook. The proxy can expose standard stdio or streamable HTTP operation. For dependable identity enforcement, use streamable HTTP with OAuth and prevent direct connector grants at the identity-provider layer.

The aggrete MCP server can also operate in adapter mode through agentgateway, Docker MCP Gateway, IBM ContextForge, or another AuthZEN-speaking gateway. The project describes this mode as appropriate when a production gateway is needed.

Tools and capabilities

  • Preview a planned call sequence with check.
  • Explore test cases with scenarios.
  • Enforce policy across connector calls and accumulated user activity.
  • Redact selected sensitive values from results.
  • Hide inaccessible tools from users.
  • Require audited, time-limited human approval for selected actions.
  • Emit hash-chained audit records, metrics, and health information.
  • Run conformance checks against real components or a gateway URL.

Limitations and notes

The aggrete MCP server is not a full gateway: it does not provide multi-tenancy, a token vault, or high availability. The project recommends placing it behind agentgateway, Docker's gateway, or IBM ContextForge for production deployments.

Stdio identity is advisory rather than a strong enforcement boundary. HTTP with OAuth is the documented option when the proxy must be the only route to connectors. Aggregation controls reduce exposure and create an audit trail, but they cannot guarantee detection when a user changes timing, paraphrases requests, or accesses systems outside the proxy's coverage.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Aggrete

aggrete is an MCP server that connects AI clients to governed upstream connectors through a policy proxy. Its main tools include `check` for previewing call sequences and `scenarios` for trying policy cases. It also tracks per-user activity, blocks disallowed combinations, redacts sensitive results, and records decisions for auditing.

Install it with `pip install aggrete` or `uv tool install aggrete`. Use `uvx aggrete --demo` for the local walkthrough, or start a configured instance with `aggrete --config proxy.config.yaml`.

Aggrete evaluates planned calls against a YAML code-of-conduct policy before fetching upstream data. It uses per-user memory across calls and sessions, can block combinations across domains, and can require human approval for selected actions.

Yes, aggrete supports streamable HTTP, and its deployment documentation covers HTTP with OAuth.

Yes, aggrete redacts emails, Social Security numbers, payment cards, and tokens from results before they reach the model. A post-call denial can redact data, but it cannot undo a fetch that already occurred.

Related MCP servers

All in Aggregators All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAggrete AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/aggrete?style=directory)](https://allmcps.com/mcp/aggrete)
HTML Embed
<a href="https://allmcps.com/mcp/aggrete"><img src="https://allmcps.com/api/badge/aggrete?style=directory" alt="Aggrete on AllMCPs" /></a>