Log inSubmit server
Cordon logo

Cordon

Routes MCP tool calls through configurable policies, audit logs, and terminal or Slack approval workflows.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Cordon

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "cordon": {
      "command": "npx",
      "args": [
        "-y",
        "@getcordon/cli"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

The install command installed and started the server, which then stopped for configuration (such as an API key) that our sandbox does not have — expected for servers that connect to your account.

npx -y @getcordon/cli

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 5d ago.

Overview

Cordon MCP server places a security gateway between an AI agent and connected MCP servers. It intercepts tool calls, applies server-level and tool-level policies, records structured audit events, and can pause selected operations for human approval. Use it when agents need controlled access to databases, filesystems, APIs, or other MCP-backed systems without changing those servers. Configuration is defined in a TypeScript file, and the CLI can import an existing Claude Desktop MCP configuration.

Use cases

  • Restrict database MCP servers to read-only access
  • Require approval before agents execute write operations
  • Audit every tool call for review or compliance
  • Hide sensitive tools from an MCP client

Key features

  • Per-server and per-tool policy enforcement
  • Structured JSON audit logging
  • Terminal and Slack approval workflows
  • Read-only and SQL-aware policies
  • Hidden tools and timed-out call replay

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

5/5 checks healthy over the last 34d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 12d ago via OSV.dev · @getcordon/cli (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars2Stargazers on the source repository.
npm downloads175Package downloads in the last 30 days.
Last commit2mo agoMost recent push to the default branch.
Install checkRunsOur sandbox started it; it then asked for an API key or config.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

How Cordon works

What Cordon does

Cordon MCP server controls how an AI agent reaches MCP tools. It sits between the agent and one or more MCP servers, which may provide access to databases, filesystems, APIs, or cloud infrastructure. Each intercepted call receives a policy decision before it is passed through or rejected.

The gateway separates read and write access, supports rules at server and tool scope, and records the request, decision, result, and timing for each call. It can also require a person to approve selected operations instead of allowing an agent to perform them automatically.

How it works

Cordon MCP server runs as a gateway in front of configured MCP servers. Its configuration identifies each server, transport, command, arguments, and default policy. Tool-specific rules can override the server default.

Supported policy behaviors described in the configuration include allowing a call, blocking it, logging it without interruption, or requiring approval. The read-only policy blocks tools identified as write operations. With approve-writes, reads pass automatically while writes wait for a decision.

Approval requests can appear in the terminal or in Slack. A pending call pauses while the approver chooses approve or deny. If the request times out, it is denied but retained with its context. A late-approved request can be replayed with the CLI; replay runs the tool call, not the original agent session.

Setup and configuration

Run npx @getcordon/cli init from the project containing claude_desktop_config.json. The initializer reads that file, creates cordon.config.ts, and updates Claude Desktop so calls pass through Cordon. Start the gateway with npx @getcordon/cli start, then restart Claude Desktop.

Manual setup is also available through npm install -g @getcordon/cli, followed by cordon init. The generated TypeScript configuration defines servers, transports, commands, policies, audit output, approval channels, and approval timeouts. Audit output can go to standard output or a file.

Tools and capabilities

Cordon MCP server provides gateway controls rather than application-specific MCP tools. Its documented capabilities include:

  • Per-server, per-tool, and global policy rules.
  • Read-only protection for a configured server.
  • Hidden tools that are removed from the client's tools/list response.
  • Structured JSON audit events for received, approved, completed, and other call states.
  • Terminal or Slack approval workflows.
  • SQL-aware read-only and approve-writes policies for database tools.
  • Replay of calls approved after an approval timeout.

SQL-aware policies parse the SQL statement instead of relying only on the MCP tool name. They use the PostgreSQL dialect by default and fail closed when SQL cannot be parsed.

Limitations and notes

Cordon does not replace the underlying MCP servers; it governs calls made through the configured gateway. The documented quickstart targets Claude Desktop. SQL-aware policies currently use the PostgreSQL dialect, with other dialects described as future work. A replay recovers only the timed-out tool call, so it does not restore the agent's prior conversation or session. A call that already ran must not be replayed because it could execute twice.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Cordon

Cordon is an MCP server that connects AI agents to configured MCP servers through a security gateway. Its main tools are policy enforcement, structured audit logging, and human approval workflows for tool calls. It can allow, block, hide, log, or pause operations before forwarding them to the underlying server.

Install it with `npx @getcordon/cli init` in the project containing your Claude Desktop configuration. The command creates `cordon.config.ts` and patches Claude Desktop; then run `npx @getcordon/cli start` and restart Claude Desktop.

Yes, Cordon supports Slack approval requests. Connect a workspace through Add to Slack in the dashboard, set the approval channel to `slack`, and flagged calls appear as Approve or Deny cards. The approver's name is added to the audit record.

Yes, Cordon provides SQL-aware read-only and approve-writes policies. These inspect the SQL statement rather than relying only on the MCP tool name. They use the PostgreSQL dialect by default and block unparseable SQL instead of allowing it.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewCordon AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/cordon?style=directory)](https://allmcps.com/mcp/cordon)
HTML Embed
<a href="https://allmcps.com/mcp/cordon"><img src="https://allmcps.com/api/badge/cordon?style=directory" alt="Cordon on AllMCPs" /></a>