Nura MCP Policy Interceptor

A lightweight, deterministic governance and policy enforcement gateway for Model Context Protocol (MCP) servers.

Features

• Hard Guardrails: Instantly drop forbidden tool execution requests before hitting systems of record.
• Dynamic Parameter Bounds: Intercept requests that exceed numerical thresholds (e.g., discounts, spend limits).
• Human-in-the-Loop Hooks: Pause high-risk operations and surface human review requests.
• Audit Telemetry: Cryptographic-ready logging for all agent-tool evaluations.

Quickstart

# 1. Install Dependencies
npm install

# 2. Build TypeScript
npm run build

# 3. Start Interceptor Server
npm start

The server uses MCP stdio transport and is intended to be launched by an MCP client.

External Policy Files

Pass a JSON or YAML policy at startup to update rules without recompiling TypeScript:

node dist/index.js --policy ./policy.json

# The npm equivalent passes arguments after --
npm start -- --policy ./policy.yaml

JSON example:

{
	"forbiddenTools": ["delete_database_record", "purge_crm_contacts"],
	"requireApprovalTools": ["issue_refund", "update_deal_stage"],
	"maxParamLimits": {
		"discountPercentage": 20,
		"amount": 1000
	}
}

YAML example:

forbiddenTools:
	- delete_database_record
	- purge_crm_contacts
requireApprovalTools:
	- issue_refund
	- update_deal_stage
maxParamLimits:
	discountPercentage: 20
	amount: 1000

Supported extensions are .json, .yaml, and .yml. Relative paths are resolved from the process working directory. Missing, malformed, or schema-invalid policy files stop startup with an error. If --policy is omitted, the built-in policy is used.

Verification

npm test

The test command builds into dist/ and verifies:

• Governance decisions use only ALLOW, BLOCK, and REQUIRE_APPROVAL.
• Forbidden tools and out-of-bounds parameters return policy failures without invoking the target executor.
• Every evaluated tool request emits a [GOVERNANCE AUDIT LOG] entry with its timestamp, decision, tool name, and reason.
• The compiled stdio server enforces built-in and external policy behavior through an MCP client.