io.github.Runestone-Labs/gatekeeper (MCP Server)

An MCP server that routes MCP tool calls through Runestone Gatekeeper for policy enforcement, optional human approval, and auditing. It allows any MCP client (e.g., Claude Desktop, Claude Code, Cursor) to execute real tool actions (shell, file writes, HTTP, or Gatekeeper tools) only via Gatekeeper rather than direct system access.

🛠️ Key Features

Runs MCP tool calls through Runestone Gatekeeper
Policy-checked tool execution
Human approval may be required
Audited actions
Gatekeeper sits in front to prevent direct system access

🚀 Use Cases

Tool-use execution from MCP clients with governance controls
Enforcing LLM-safety/guardrails for shell, file, and HTTP actions
Using Gatekeeper tools under MCP

⚡ Developer Benefits

Centralized policy engine for agent-governance
Human-in-the-loop approval and audit trail
Integration with MCP model-context-protocol workflows

⚠️ Limitations

Tool calls must go through Runestone Gatekeeper; the model does not access systems directly

Runestone Gatekeeper — MCP Server

An MCP server that lets any MCP client (Claude Desktop, Claude Code, Cursor, …) run real tool calls — shell, file writes, HTTP, or any Gatekeeper tool — only through Runestone Gatekeeper. Every call is policy-checked, may require human approval, and is audited. The model never touches your systems directly; Gatekeeper sits in front.

code

MCP client (LLM)  ──tools/call──▶  gatekeeper-mcp  ──policy-gated──▶  Gatekeeper  ──▶  shell / files / HTTP

Requirements

A running Gatekeeper server (see the repo root). This package is just the MCP front door; it does nothing on its own.

Install / configure

It runs over stdio. Add it to your MCP client config, e.g. Claude Desktop (claude_desktop_config.json):

json

{
  "mcpServers": {
    "gatekeeper": {
      "command": "npx",
      "args": ["-y", "@runestone-labs/gatekeeper-mcp"],
      "env": {
        "GATEKEEPER_URL": "http://127.0.0.1:3847",
        "GATEKEEPER_ROLE": "openclaw"
      }
    }
  }
}

Env	Required	Default	Meaning
`GATEKEEPER_ROLE`	yes	—	The policy role this server presents to Gatekeeper for every call.
`GATEKEEPER_URL`	no	`http://127.0.0.1:3847`	Gatekeeper base URL.
`GATEKEEPER_AGENT_NAME`	no	`mcp-client`	Name recorded in audit logs.

Shared approvals for unattended agents

Local Gatekeeper and this MCP integration are free. Need a teammate to handle approvals while your agents run unattended? We're testing Gatekeeper Team at $49/month, for up to five members and five instances. The proposed Cloud service would coordinate a held action, a teammate's approval or denial, and a record of the outcome. Cloud is planned, not publicly available, and no payment is collected during this test. Only actions actually routed through Gatekeeper are covered; installing the MCP server does not cover a client's other tools.

See the proposed workflow and share your team's needs. The form also lets you optionally report a first real routed action or return use on a later day. These are manual self-reports, not verified external activation. Don't send commands or raw audit logs; this test adds no automatic usage reporting to the MCP server.

Tools

Tool	Gatekeeper tool	Use
`shell_exec`	`shell.exec`	Run a shell command.
`files_write`	`files.write`	Write a file.
`http_request`	`http.request`	HTTP GET/POST (egress-policed).
`gatekeeper_call`	(any)	Generic escape hatch — call any Gatekeeper tool (e.g. `memory.query`) by name.
`gatekeeper_health`	—	Check the Gatekeeper server is reachable.

Every gated call returns one of:

allow → the tool output.
deny → an error result explaining why (the call did not run).
approve → an error result saying a human must approve it in Gatekeeper; the call did not run.

Security model

This server is a policy boundary, so it is deliberately strict:

Identity is pinned server-side. Role comes from GATEKEEPER_ROLE; origin is fixed to model_inferred and taint to mcp_client. The MCP client cannot set or override actor / role / origin / taint / capability tokens via tool arguments — there is no code path from a tool argument to any of those.
Fail closed. A deny, a pending approval, or any malformed/unexpected Gatekeeper response is surfaced as an error — never as a successful result.
No endpoint traversal. Generic tool names are validated as strict dotted identifiers; ../, slashes, and the like are rejected before any request.
No leakage. The Gatekeeper URL and anything resembling a credential are scrubbed from error messages before they reach the client.

These invariants are covered by an adversarial test suite (src/*.test.ts).

Distribution

Published to npm as @runestone-labs/gatekeeper-mcp and listed on the MCP Registry as io.github.runestone-labs/gatekeeper (see server.json). The MCP Registry is in preview.

License

Apache-2.0

io.github.Runestone-Labs/gatekeeper