Transparent MCP proxy · TypeScript

The audit and governance layer for MCP.

Drop mcpose between any LLM client and any MCP server. Intercept, transform, and govern every tool call through composable onion middleware — and log it in a tamper-evident, compliance-grade audit trail. Nothing upstream changes.

$npm install mcpose

Get started →GitHub

v2.x on npm·MIT·Node 20+·ESM, types included·semver-disciplined

proxy.tsTypeScript
// Wrap any upstream MCP server — unmodified
const backend = await createBackendClient({
  command: 'node',
  args: ['./es-server.mjs'],
});

const audit = createAuditMiddleware({
  signingKey: createDefaultSigningKeyProvider(process.env.AUDIT_SECRET!),
  onEvent: (e) => auditLog.append(e), // HMAC-chained, tamper-evident
});

await startHttpProxy(backend, {
  hiddenTools: ['delete_index'],        // rejections are audited too
  toolMiddleware: [redactPii, audit.middleware],
});                     // audit only ever sees redacted data

Why mcpose

Cross-cutting concerns, composed.

Transparent proxy

Wrap any upstream MCP server without modifying it. The client sees a normal server; the upstream sees a normal client.

Onion middleware

Each layer runs before and after the inner pipeline. Predictable ordering, fully typed, composable.

Governance

Hide or gate tools and resources per caller. Every blocked call carries a structured RejectionReason.

Identity

Resolve a caller once per session — JWT, mTLS, API key — then stamp the Identity on every request.

Tamper-evident audit

HMAC-chained events and a signed Merkle replay manifest per session, via @mcpose/audit.

Production transport

HTTP/SSE with mTLS, session limits, and reconnect replay — or plain stdio. Abort signals and progress relay through.

Concept

One proxy in the middle.

mcpose mirrors the upstream MCP surface and routes supported calls through middleware. Capabilities, abort signals, progress, and list-changed notifications pass through intact.

LLM client

Claude · Cursor · any MCP client

MCP

http · sse · stdio

mcpose:3000/mcp

identity resolution

visibility filters

middleware pipelines

audit trail

MCP

stdio · http

Upstream server

any MCP server — unmodified

Three routing paths per tool or resource

Hidden

hiddenTools · hiddenResources

Omitted from list responses; rejected with TOOL_HIDDEN at call time. The rejection still hits the audit trail.

Pass-through

passThroughTools · passThroughResources

Forwarded raw. Transformers are skipped; observers wrapped in markPassThroughObserver() still run.

Middleware

everything else

Routed through the full toolMiddleware / resourceMiddleware pipeline.

@mcpose/audit

Audit trails an examiner can verify.

Built for DORA Art. 17 and SR 11-7. Every event chains to the last; every session closes with a signed Merkle manifest. Extracted from a production financial deployment.

HMAC-chained events

chainHash = HMAC(entry || prevChainHash) — truncation, reordering, and rewrites are detectable.

Replay manifest

A signed Merkle-proof document per session. A third party can verify a single event without access to the full log.

Sensitivity tiers

Classify every tool call; high-tier payloads are encrypted with AES-256-GCM and a per-event key.

Never in the hot path

Audit failures go to onAuditError — a tool call never fails because logging did.

e₀

hmac

e₁

hmac

e₂

hmac

…

manifest ✓

Tier	Stored fields
low	inputRaw, outputRaw (plaintext)
medium	inputRaw, outputRaw (PII redacted upstream)
high	inputEncrypted, outputEncrypted (AES-256-GCM)

Unknown tools always resolve to 'high'.

Packages

Three packages, one surface.

Package	What it does	Version
mcpose	Proxy core — pipeline, transports, identity, governance.	v2.x
@mcpose/audit	Tamper-evident HMAC audit chain + Merkle replay manifest.	v3.0 · format v2
@mcpose/testing	Runner-agnostic compliance assertions for the audit chain.	devDependency

Peer dependency: @modelcontextprotocol/sdk ≥ 1.0 — installed separately.

Drop it in front of any MCP server.

Ten lines of glue. Nothing upstream changes.

$npm install mcpose

Read the docs →