Marchward MCP

What Marchward MCP MCP server does

Marchward MCP MCP server places an authority layer between an AI agent and the tools it can call. It evaluates each MCP or HTTP action before execution and returns one of three decisions: ALLOW, BLOCK, or ESCALATE. Escalated actions can wait for human approval rather than running unattended.

The system addresses four operational concerns:

• Credential mediation keeps real GitHub, Stripe, database, or other service credentials outside the agent. The agent uses a Marchward key, while the proxy injects the actual credential at execution time.
• Spend controls provide a hard ceiling for inference spending. In the self-hosted packages, cost accounting is local; the hosted plane can enforce rolling-window spend.
• Approval gates allow policies to pause actions considered irreversible or destructive.
• Tamper-evident auditing appends decisions to a hash-chained log that can be verified offline.

Risk evaluation considers the resolved action, not only the tool name. For example, destructive DELETE operations or flagged destructive POST requests can be gated even when a custom tool name does not contain an obvious warning.

How it works

An agent sends a tool call through the Marchward proxy, an SDK wrapper, or an HTTP integration. The decision engine compares the request with the configured policy before forwarding an allowed call. Blocked calls do not run, and escalated calls pause for approval where the configured deployment supports the workflow.

The open packages include @marchward/engine for deterministic decisions and the hash-chain audit primitive, @marchward/proxy for local MCP and HTTP interception, and TypeScript and Python clients. The proxy can run locally or point to the hosted plane. In local mode, the process can wrap another MCP server as a child process and write its audit log on the same machine.

Setup and configuration

Marchward MCP MCP server can run fully locally without an account or network request to the hosted service. Install the proxy with npx -p @marchward/proxy marchward-proxy, provide a policy file, and pass the wrapped server command with --command. Use --local for local enforcement. Policies can match tool patterns and assign decisions such as ESCALATE for destructive tools and ALLOW for other calls.

For SDK-based applications, install the Python package with pip install marchward and wrap execution with marchward.execute(). The TypeScript SDK is provided as @marchward/sdk. Deployments can use a local credential store or connect the proxy to the hosted plane with its remote mode.

Tools and capabilities

• Intercept MCP and HTTP tool calls before execution
• Apply allow, block, and escalate policy decisions
• Mediate credentials so agents do not receive real service secrets
• Track local inference cost or use hosted rolling-window enforcement
• Append decisions to a hash-chained audit log
• Verify the local audit record offline
• Wrap an MCP server as a child process
• Use TypeScript or Python SDK clients

Limitations and notes

The repository provides a self-hosted governor, but some operational features belong to Marchward Cloud. Managed credential storage, rotation, team sharing, multi-tenancy, SSO/RBAC, retained and monitored audit records, approval notifications, approval-and-resume workflows, and cross-agent enforcement are hosted features.

The local packages still provide execution control, local credential mediation from an existing secret store, local cost accounting, approval decisions, and a local audit log. The hosted free tier is described as allowing 500 decisions per month without a payment card. The code is licensed under Apache-2.0; the project name is separately protected by its trademark terms.