Skip to content

MCP Zero Trust Layer 0.1.0

Pre-release
Pre-release

Choose a tag to compare

View all tags
@686f6c61 686f6c61 released this 13 Jun 20:01
v0.1.0
3f21f3a

MCP Zero Trust Layer 0.1.0

Initial developer preview of MCP Zero Trust Layer, an open-source and self-hosted Zero Trust policy enforcement layer for MCP servers. MCPZT runs in front of existing MCP servers and gives teams a place to enforce policy, approvals, argument validation, output controls, audit and observability without rewriting the upstream MCP server.

This release is marked as a draft pre-release while PyPI Trusted Publishing is configured. Publishing the release later will trigger the PyPI workflow.

Highlights

  • HTTP proxy runtime for MCP Streamable HTTP POST requests.
  • Stdio wrapper runtime for command-based MCP servers.
  • Multi-MCP routing with per-server policy isolation through /mcp/{server_name}.
  • Deterministic policy engine with allow, deny, hide, require_approval, redact, limit, transform and log effects.
  • mcpzt policy explain for debugging matched policies, skipped policies and selected decisions.
  • Parameter-level policy controls through native input blocks.
  • Built-in validators for SQL, filesystem paths, URLs, email, regex, required/forbidden fields and field sizes.
  • Human approval flow with approval binding to identity, server, capability, policy and argument hash.
  • Output enforcement for JSON-RPC result and error payloads.
  • Capability discovery, diffing and deterministic security scanning.
  • JSONL audit logging with recursive secret redaction and hash-chain verification.
  • Prometheus-format decision metrics.
  • Auth modes for none, static token, API key, JWT and OIDC/JWKS.
  • Secret references with env:, ${VAR}, file:, op://, aws-sm:// and vault://.
  • Optional OPA policy adapter.
  • Dockerfile, production Docker Compose recipe and Helm starter chart.
  • Public docs for multi-MCP use cases, production operations and PyPI release flow.

Try It Locally

From a checkout:

python -m venv .venv
. .venv/bin/activate
python -m pip install -e ".[dev]"
mcpzt version
mcpzt init --config mcpzt.yaml --force
mcpzt config validate --config mcpzt.yaml

From the attached wheel:

python -m venv /tmp/mcpzt-wheel-smoke
/tmp/mcpzt-wheel-smoke/bin/python -m pip install ./mcp_zero_trust_layer-0.1.0-py3-none-any.whl
/tmp/mcpzt-wheel-smoke/bin/mcpzt version

With Docker:

docker build -t mcpzt:local .
docker run --rm mcpzt:local version

Release Artifacts

  • mcp_zero_trust_layer-0.1.0.tar.gz
  • mcp_zero_trust_layer-0.1.0-py3-none-any.whl

The source distribution was inspected to ensure internal planning files, local audit files, approval stores, secrets, virtual environments, caches and generated build directories are excluded.

Validation

  • ruff check . passed.
  • pytest -q passed with 82 tests.
  • python -m build passed.
  • twine check dist/* passed.
  • GitHub Actions CI passed on main.

Known Notes

  • This is a developer preview, not a 1.0 stability promise.
  • HTTP GET SSE streams are not implemented in this release; the HTTP endpoint returns 405 for GET.
  • Request-scoped upstream SSE passthrough is intentionally left for a later release because streaming needs a separate security design.
  • The local approval store is file-backed. Horizontal production deployments should use storage with correct locking semantics or wait for a shared approval backend.
Assets 4
Loading