AtlaSent MCP Server

What AtlaSent MCP Server does

AtlaSent MCP Server exposes authorization primitives to MCP hosts so an agent can ask whether a proposed action may run before invoking the native operation. Its core sequence is evaluation, permit verification, and execution: a deny, hold, escalation, invalid permit, expired permit, replay, context mismatch, or verification error stops the protected action.

The server includes deploy_service as a protected deployment example. That tool authorizes and verifies each call before the simulated deployment proceeds. The package also exposes read-only inspection and governance functions, including policy listing, audit-event retrieval, permit listing, authority explanations, integrity audits, canonical action lookup, and Knowledge Atlas concept lookup.

How it works

With no credentials, the server uses local mode and an in-process rules engine. Its built-in rules deny production actions without approvals, hold several destructive or release-related actions, and issue a single-use permit with a five-minute lifetime for actions that pass. Local permits are unsigned and are intended for development, CI, and experimentation; the server refuses to fall back to this mode when NODE_ENV=production.

Remote mode uses an AtlaSent policy engine. atlasent_evaluate returns allow, deny, hold, or escalate; an allowed result includes a permit token. Held actions can wait for a human decision through atlasent_await_approval, but an approval still requires verify_permit before execution. Permit verification must occur at the execution boundary, using the relevant execution context and, for some agent actions, the returned payload hash and actor ID.

Batch and streaming evaluation support up to 100 actions. The GraphQL tool provides a constrained read-only query surface. Several remote V2 features are closed by default and report a feature-disabled error when unavailable.

Setup and configuration

Run the local package directly with:

npx -y @atlasent/mcp-server

An MCP host can configure it as a stdio server:

{
  "mcpServers": {
    "atlasent": {
      "command": "npx",
      "args": ["-y", "@atlasent/mcp-server"],
      "env": { "ATLASENT_MODE": "local" }
    }
  }
}

For a source checkout, install dependencies, build the project, and run its offline demo:

git clone https://github.com/AtlaSent/atlasent-mcp-server.git
cd atlasent-mcp-server
npm install
npm run build
npm run demo

Docker supports both local stdio execution and remote execution with ATLASENT_API_KEY and ATLASENT_BASE_URL. VQP generation and verification additionally require ATLASENT_SUPABASE_URL and ATLASENT_SUPABASE_SERVICE_ROLE_KEY.

Tools and capabilities

• Evaluate one action, or up to 100 actions in batch or streaming mode.
• Verify a permit before a protected native effect.
• Wait for human approval of a held action.
• Inspect policies, permits, audit events, authority paths, and integrity findings.
• Look up canonical action specifications and AtlaSent concepts.
• Retrieve evidence exports and run VQP scoring or tamper checks.
• Analyze supplied GitHub Actions workflow text for ungated deployment, publishing, migration, and infrastructure steps.
• Query the supported read-only GraphQL surface.

Limitations and notes

Local mode is a credential-free demonstration and does not provide signed production authority. The evidence-gap and exposure-review tools are offline and only analyze workflow files supplied to them; they cannot see repository settings, activity outside CI, or the internals of deployment scripts. Integrity audits return findings without synthesizing a pass/fail verdict, and unresolved findings must not be treated as clean results. Remote policy, batch, streaming, and GraphQL features may be disabled per tenant.