cMCP - Hardware-attested policy enforcement for MCP tool calls

Show HN: cMCP, deny an AI agent's tool call and get a signed receipt

cMCP is an open-source gateway that enforces MCP tool-call policies inside a hardware Trusted Execution Environment (TEE). It intercepts every tool call, evaluates it against a Cedar policy bundle, and blocks or redacts denied calls, producing a signed, tamper-evident TRACE Claim as proof. With support for TPM, AMD SEV-SNP, Intel TDX, and a software-only dev mode, cMCP provides verifiable governance for AI agents, ensuring data leakage prevention and regulatory compliance.