Decide what an AI can touch. Keep a record of everything it did.

What you get

What's in the library.

The code

Swap one decorator and the gate is in.

Build your MCPServer as usual, then register tools with @gatehouse.tool instead of the server's own decorator. That's the whole integration.

from mcp.server.mcpserver import MCPServer
from mcp_gatehouse import AccessTier, AuditLog, Gatehouse, Policy, terminal_approver

mcp = MCPServer("order-desk")
gatehouse = Gatehouse(
    mcp,
    policy=Policy(approver=terminal_approver),
    audit=AuditLog(path="~/order-desk/audit.jsonl"),
)

@gatehouse.tool(tier=AccessTier.READ)
def lookup_order(order_id: str) -> str:
    """Look up an order's status."""
    ...

@gatehouse.tool(tier=AccessTier.DESTRUCTIVE)
def cancel_order(order_id: str) -> str:
    """Cancel an order. Runs only if the approver says yes."""
    ...

mcp.run()

Your tools keep their signatures, so schema generation, parameter descriptions and transports all work the way they did before. Sync tools still run in a worker thread, the same as on a plain MCPServer.

To make writes wait for a yes as well, it's one line: Policy(require_approval=frozenset({AccessTier.WRITE, AccessTier.DESTRUCTIVE})). To mask a key of your own without losing the defaults: Policy(redact=DEFAULT_REDACT | {"card_pin"}).

The full README on GitHub ↗

Try it

A demo order desk, with the gate closed.

The package comes with a small order-desk server: four tools across all three tiers. Add it to Claude Desktop, or any MCP client that runs servers over stdio. For Claude Desktop, it goes in claude_desktop_config.json:

{
  "mcpServers": {
    "gatehouse-demo": {
      "command": "uvx",
      "args": ["mcp-gatehouse", "--audit-log", "/tmp/gatehouse-audit.jsonl"]
    }
  }
}

Ask the model to list the orders, then cancel one. The cancel needs a yes typed into a terminal. A desktop client starts the server in the background, with no terminal to ask, so the cancel gets refused. That's the gate failing closed.

To approve one yourself, run the server from a terminal (mcp-gatehouse-demo, after pip install mcp-gatehouse) so the prompt has somewhere to appear. Either way, the verdict ends up in the audit log, and the server prints the log's path when it starts.

Design choices

Why the gate lives inside your server.

A proxy in front of your server can't see what your tools do. A separate policy service is one more thing to deploy and keep running, and a 40-person plant doesn't have a platform team to run it. The place that knows a lookup from a cancel is the tool itself, so that's where the tier is declared and where the gate is enforced.

It fails closed everywhere it can, because a security default that quietly allows is worse than none. A missing approver means no. An approver that crashes means no. A value the redactor can't take apart is swapped for a placeholder instead of going into the log as it is.

What it isn't

• ×Authentication. It doesn't check who is connecting to your server.
• ×Transport encryption.
• ×A sandbox for your tool code.
• ×Protection from a server author with bad intentions. Give a third-party MCP server the same scrutiny as any software you install.

It's a gate inside your server, for what an AI that's already connected is allowed to do. If you find a security problem, email nick@nickgeorgeai.com instead of opening a public issue. You'll hear back within 72 hours.

Compatibility

SDK v2 today, v1 still covered.

Tested in CI on every Python from 3.10 to 3.14. The public API (Gatehouse, Policy, AuditLog, AccessTier) hasn't changed across those versions, as promised when SDK v2 was still on its way. Porting a v1 server is two import edits. Staying on v1 takes no action at all: 0.1.x pins mcp<2, and it still gets security fixes.

mcp-gatehouse on PyPI ↗Release notes ↗

Common questions

Questions about mcp-gatehouse.

Testing an agent before it gets near real data? fieldtwin, my open-source Jobber and QuickBooks twins →