protect-mcp-governance
Agent governance skill for MCP tool calls — Cedar policy authoring, shadow-to-enforce rollout, and Ed25519 receipt verification.
Profile →npx skills add sickn33/agentic-awesome-skills --skill protect-mcp-governance --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# MCP Agent Governance with protect-mcp ## Overview Guidance for governing AI agent tool calls using Cedar policies and Ed25519 signed receipts. This skill teaches how to write access-control policies for MCP servers, run them in shadow mode for observation, and verify the cryptographic audit trail. ## When to Use This Skill - Use when you need to control which MCP tools an agent can call and under what conditions - Use when you want a tamper-evident audit trail for agent tool executions - Use when rolling out governance policies gradually (shadow mode first, then enforce) - Use when authoring Cedar policies for MCP tool access control - Use when verifying that a receipt or audit bundle has not been tampered with ## Do Not Use This Skill - When you need general application security auditing (use `@security-auditor`) - When you need to scan code for vulnerabilities (use `@security-audit`) - When you need compliance framework guidance without agent-specific governance ## How It Works protect-mcp intercepts MCP tool calls, evaluates them against Cedar policies (the same policy engine used by AWS Verified Permissions), and signs every decision as an Ed25519 receipt. The receipt is a cr
- Overview
- When to Use This Skill
- Do Not Use This Skill
- How It Works
- Core Concepts
- Cedar Policies
- Signed Receipts
- Step-by-Step Guide
- 1. Initialize Governance for a Project
- 2. Write Your First Policy
- 3. Run in Shadow Mode (Observe First)
- 4. Tighten and Enforce
- 5. Verify Receipts
- Examples
Install and initialize hooks (Claude Code integration) npx protect-mcp init-hooks Or run as a standalone MCP gateway npx protect-mcp serve Shadow mode is the default — logs decisions without blocking npx protect-mcp --policy policy.cedar -- node your-mcp-server.js npx protect-mcp --policy policy.cedar --enforce -- node your-mcp-server.js Verify a single receipt npx @veritasacta/verify receipt.json --key <public-key-hex> Verify an audit bundle (multiple receipts + keys)
What does the protect-mcp-governance skill do?
Agent governance skill for MCP tool calls — Cedar policy authoring, shadow-to-enforce rollout, and Ed25519 receipt verification.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill protect-mcp-governance --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.