Control Plane

What control-plane does

The control-plane MCP server exposes 72 MCP tools covering AI governance, guardrails, FinOps, smart routing, trust scoring, registry operations, observability, business-value analysis, policy, compliance, benchmarking, caching, security, memory, scheduling, alerts, and related functions. The repository also includes 24 A2A skills through a bridge between MCP and Google’s Agent-to-Agent Protocol version 0.3.0.

Its open-source defense component, ThinkShield, combines a detection engine with five rule packs and ASGI middleware. The packs address injection patterns such as SQL injection, XSS, command injection, and path traversal; authentication abuse; rate and resource abuse; reconnaissance; and header anomalies. The project reports 145 ThinkShield tests and a p99 latency below 1 ms for the defense layer.

How it works

MCP clients connect to the server and call its annotated tools. The implementation also provides two resources, two prompts with completions, configurable logging, and completion support for workspaces, providers, and models. Tool annotations include read-only, destructive, idempotent, and open-world hints.

A2A agents can use the MCP-A2A bridge and its 24 exposed skills. The open repository supplies the tools and ThinkShield layer, while governance orchestration, the AIRGP policy engine, cryptographic audit chaining, tenant management, enterprise integrations, and SLA support belong to the commercial ThinkNEO Platform rather than this codebase.

Setup and configuration

For a local deployment, clone the repository, install the packages from requirements.txt, and start the ASGI application with Uvicorn on port 8081. Docker Compose is available under the deploy directory. The documented hosted endpoint is https://mcp.thinkneo.ai/mcp, which can be connected from Claude Desktop, Cursor, or another MCP client. The hosted service advertises a free allowance of 500 calls per month and automatic API-key provisioning.

The README does not specify required environment variables or a configuration file. It does document a test command using Pytest, which can run the repository’s test suite after installation.

Tools and capabilities

The control-plane MCP server groups its tools into these documented areas:

• Governance, guardrails, policy, and compliance
• FinOps, token tracking, optimization, and smart routing
• Trust scoring, registry operations, and provider-related functions
• Observability, alerts, audit export, and outcome validation
• Business-value analysis, benchmarking, caching, memory, and scheduling
• Security and ThinkShield defense operations
• A2A control and MCP-A2A bridging

The protocol implementation targets MCP 2024-11-05 and states forward compatibility with MCP 2025-03-26. Logging supports eight levels, per-session handling, and an audit trail.

Limitations and notes

This control-plane MCP server is not the complete ThinkNEO enterprise platform or a standalone security product. Its open repository contains the detection and governance-facing components described above, but proprietary platform services provide the broader orchestration and enterprise features. Choose a local deployment when you need to run the repository yourself; use the hosted endpoint when an MCP client can connect to the documented service. The repository is licensed under Apache-2.0.