See what your agent did. Verify nobody tampered with the record. Stop broken retries. A drop-in governance proxy for any MCP tool server. One command to add tamper-evident receipts, failure memory, and authority tracking. No config. No server. Watch governance happen: receipts, failure memory, automatic blocking, hash chain verification — all in 5 seconds. Your agent doesn't know the proxy exists.
Add this skill
npx mdskills install born14/mcp-proxyGovernance proxy for MCP servers providing tamper-evident receipts, failure memory, and authority tracking
1# @sovereign-labs/mcp-proxy23**See what your agent did. Verify nobody tampered with the record. Stop broken retries.**45A drop-in governance proxy for any MCP tool server. One command to add tamper-evident receipts, failure memory, and authority tracking.67## See It In Action (1 command)89```bash10npx @sovereign-labs/mcp-proxy --demo11```1213No config. No server. Watch governance happen: receipts, failure memory, automatic blocking, hash chain verification — all in 5 seconds.1415## The Trust Demo (4 commands)1617```bash18# 1. Govern your filesystem server19npx @sovereign-labs/mcp-proxy --wrap filesystem2021# 2. Use Claude Code normally — every tool call is now receipted2223# 3. See what happened24npx @sovereign-labs/mcp-proxy --view --state-dir .governance-filesystem2526# 4. Verify the record is intact27npx @sovereign-labs/mcp-proxy --verify --state-dir .governance-filesystem28```2930Your agent doesn't know the proxy exists. Your MCP server doesn't know either. But now you have proof.3132## What --view shows3334```35 RECEIPT LEDGER36 ===============================================================37 controller: a1b2c3d4...38 integrity: verified39 showing: 10 receipts40 ---------------------------------------------------------------4142 ok # 0 2026-03-06 14:22:00 42ms read_file43 target: /tmp/config.json44 hash: c0a4271c5fd1df01...4546 ok # 1 2026-03-06 14:22:01 103ms write_file [MUTATION]47 target: /tmp/config.json48 hash: 1bc5e6ac12056651...4950 ok # 2 2026-03-06 14:22:03 38ms read_file51 target: /tmp/app/server.js52 hash: 32f85d3474b9d3a0...5354 !! # 3 2026-03-06 14:22:04 12ms write_file [MUTATION]55 target: /tmp/secret.key56 error: Permission denied57 hash: 5fc519e7c92658ef...5859 -- # 4 2026-03-06 14:22:06 1ms write_file [MUTATION]60 target: /tmp/secret.key61 blocked by: write_file+/tmp/secret.key (known failure)62 hash: abadd7890802c0ac...6364 ok # 7 2026-03-06 14:22:10 87ms write_file [MUTATION]65 target: /tmp/app/server.js66 hash: e20b2fd706abdeea...6768 ---------------------------------------------------------------69 10 receipts | 5 mutations | 1 blocked | 1 errors70```7172Receipt #3 fails. Receipt #4 is the same call — the proxy blocks it automatically because it already failed. No wasted retries. No prompt engineering. Structural.7374## What --verify shows7576```77 CHAIN VERIFICATION78 ===============================================================7980 receipts: 1081 chain depth: 1082 integrity: all hashes verified83 controller: a1b2c3d4...84 first hash: c0a4271c...85 last hash: 66c88893...86```8788If anyone modifies a receipt after the fact:8990```91 integrity: TAMPERED at seq 392```9394## Packages9596| Package | Description | npm |97|---------|-------------|-----|98| [@sovereign-labs/mcp-proxy](packages/mcp-proxy/) | Drop-in governance proxy for MCP tool servers | [](https://www.npmjs.com/package/@sovereign-labs/mcp-proxy) |99| [@sovereign-labs/kernel](packages/kernel/) | Governance kernel — 7 structural invariants as pure functions | [](https://www.npmjs.com/package/@sovereign-labs/kernel) |100101**mcp-proxy** is the thing you install. **kernel** is the governance math underneath it.102103See [packages/mcp-proxy/README.md](packages/mcp-proxy/README.md) for full documentation — CLI reference, enforcement modes, constraint learning, programmatic API.104105## Three Guarantees1061071. **Receipts** — Every tool call produces a hash-chained record. Like git commits for tool execution. Tamper with one receipt and the chain breaks.1081092. **Constraints** — When a tool call fails, the proxy fingerprints the failure and blocks identical calls within a TTL window. Your agent can't repeat the same mistake.1101113. **Authority** — A stable controller ID and monotonic epoch counter. You can prove which controller was active and whether authority was still valid when a call was made.112113## Status114115Public beta. Tested cold-install path (`npx`) on Node >= 18.116117```bash118npm install @sovereign-labs/mcp-proxy119```120121## License122123MIT124
Full transparency — inspect the skill content before installing.