The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the SafeNode MCP Gateway listing page.
An MCP proxy that enforces policy on every tool call. The agent cannot route around it.
An MCP server that exposes an evaluate_action tool is theatre. The model can choose not to call
it, which means it enforces nothing.
This is a proxy. It sits between your MCP client (Claude Desktop, Claude Code, Cursor, any MCP
host) and the MCP servers you already use. tools/list passes straight through, so the model sees
exactly the tools it saw before. Every tools/call is evaluated against SafeNode first. A denial
means the call never reaches the downstream server at all.
Your agent needs no code changes. It does not know the gateway is there.
Get an API key — free tier, no card · Docs · Python SDK
Free at safenode.tech. Keys look like sn_....
safenode-gateway.json — take the servers straight out of your existing MCP client config:
Do not put your API key in this file. Set SAFENODE_API_KEY in the environment — it takes
precedence over the config, so the file stays safe to commit.
Prints the exact JSON body that an evaluation would POST. No network call. This is the fastest way to satisfy yourself about what leaves your machine.
Claude Desktop — claude_desktop_config.json:
Claude Code — .mcp.json in your project:
Cursor — ~/.cursor/mcp.json, same shape as Claude Desktop.
Replace your existing server entries with this one. The gateway spawns them itself, so listing them in both places would run each server twice.
| Decision | Behaviour |
|---|---|
allow | Forwarded. The downstream result is returned unchanged. |
warn | Forwarded, with a [SafeNode warning] line prepended so the model and the human see it. |
review | Not forwarded. Returns a message saying approval is needed. |
deny | Not forwarded. Returns the human-readable reasons and the trace_id. |
Denials come back as MCP tool errors, not transport failures, so the model sees why and can try something else instead of the host surfacing an opaque crash.
failMode decides what happens when SafeNode itself is unreachable.
fail_closed (default) | Block the call. |
fail_open | Forward it, unevaluated. |
raise | Crash the gateway. |
The gateway defaults to fail_closed, unlike the SafeNode SDKs, which default to fail_open.
That difference is deliberate. An SDK wraps a developer's own code, where taking production down
during a SafeNode outage loses the user forever. The gateway fronts arbitrary MCP tools it knows
nothing about — filesystem writes, shell commands, payments — and silently letting all of that
through the moment SafeNode is unreachable defeats the point of installing it.
Loosen it per tool for the read-only ones:
Degraded decisions are logged to stderr and marked "degraded": true with a null traceId in the
decision log, so they can never be counted as real policy decisions.
For every tool call, the gateway sends: the tool name, the downstream server name, a session id, any static context from your config, and the tool arguments as the payload.
payloadMode controls the arguments:
full | Sent verbatim. |
redacted (default) | Scrubbed client-side first. |
metadata_only | No values at all — key names and hashes only. |
Redaction covers emails, Luhn-validated credit cards, US SSNs, provider API key prefixes (sk-,
ghp_, xoxb-, AKIA, AIza), bearer tokens, and PEM private key blocks. Values become
[REDACTED:<type>].
Alongside the redacted payload, the gateway sends counts of what it removed:
This is load-bearing. SafeNode's server-side sensitive_data rule matches patterns against payload
values. If the gateway scrubbed those values and said nothing, a policy of "deny any action
containing a card number" would silently start passing — the client-side privacy feature would have
disabled the server-side security control. Reporting counts closes that: policy can act on the
presence of a card number without ever receiving one.
If you use sensitive_data with patterns, pair it with a redaction_metadata rule.
These counts are self-reported. They raise the floor for an honest client; they are not a defence against a hostile one.
The gateway talks to exactly two things: the downstream MCP servers you configured, and the SafeNode API. No analytics, no phone-home, no postinstall scripts.
Set logFile to get a JSONL record of every decision, independent of the server-side audit trail —
so you still have evidence of what your agent tried to do when the network was down:
| Key | Default | Meaning |
|---|---|---|
apiKey | — | Prefer SAFENODE_API_KEY in the environment |
baseUrl | https://safenode.tech | For staging |
failMode | fail_closed | fail_closed | fail_open | raise |
payloadMode | redacted | full | redacted | metadata_only |
timeoutMs | 5000 | Evaluation request budget |
logFile | null | JSONL decision log path |
prefixTools | false | Force <server>__<tool> naming |
servers[] | required | Downstream MCP servers |
tools{} | {} | Per-tool overrides |
context{} | {} | Static context on every evaluation |
failMode, payloadMode and context can be set globally, per server, or per tool. Most specific
wins.
tools.<name>.bypass: true skips evaluation entirely for one tool. It does what it says — the call
is forwarded with no policy check at all.
If two downstream servers export the same tool name, the gateway prefixes every tool with
<server>__ and logs a warning. Silently picking a winner would apply one server's policy to
another server's tool, which is a security bug rather than a cosmetic one.
Each gated tool call adds one round trip to the SafeNode API, with a 5000ms budget by default. Bypassed tools add nothing.
A measured p99 for the evaluate endpoint is not published yet, because it has not been measured under realistic load. When it has been, it will go here and in the docs rather than being estimated.
Running it with no arguments starts against a bundled demo config that proxies an included echo server, so you can see the proxy work without any setup:
The demo key is a placeholder, so tools/list passes through while any real tool call is denied by
the fail_closed policy. For real use, mount your own config and supply a key:
-i is required. MCP speaks JSON-RPC over stdio, so without stdin attached the gateway has nothing
to talk to.
Node 18+. One runtime dependency: @modelcontextprotocol/sdk.
See CONTRIBUTING.md. Bug reports about enforcement gaps — anything that reaches a downstream server when it should have been blocked — are the most valuable thing you can file.
See SECURITY.md. Please do not open public issues for vulnerabilities.
MIT. See LICENSE.