@limitrum/mcp-server

MCP server and local HTTP gateway for Limitrum policy verification.

Use it with Claude Desktop, Claude Code, Cursor, and other MCP-compatible clients to put Limitrum before sensitive tool execution.

Use it as the guard step in an MCP gateway:

MCP-compatible agent -> limitrum_guard -> sensitive tool

If the verdict is blocked, the sensitive tool should not be called.

It also exposes protected tools that perform the guard step internally:

• limitrum_guard: verify any proposed intent.
• limitrum_http_fetch: protected HTTP fetch.
• limitrum_shell_exec: protected shell command.
• limitrum_github_create_issue: protected GitHub issue creation.
• limitrum_stripe_create_charge: protected Stripe charge dry-run.

pnpm add @limitrum/mcp-server

pnpm --filter @limitrum/mcp-server dev

Claude Desktop / Cursor config:

{
  "mcpServers": {
    "limitrum": {
      "command": "limitrum-mcp-server",
      "args": [],
      "env": {
        "LIMITRUM_MCP_AGENT_ID": "agent_local"
      }
    }
  }
}

Protected tools are dry-run by default. Explicit execution flags:

LIMITRUM_MCP_ENABLE_NETWORK=true
LIMITRUM_MCP_ENABLE_SHELL=true
LIMITRUM_MCP_ENABLE_GITHUB=true
GITHUB_TOKEN=...

Stripe remains dry-run in the public MCP server. Wrap your own real Stripe call with guardTool() when you want production execution.

SSE mode:

pnpm --filter @limitrum/mcp-server dev:sse

HTTP gateway mode is exposed by the same SSE server:

pnpm gateway:dev

Endpoints:

• GET /health
• GET /v1/openapi.json
• POST /v1/verify-intent
• GET /sse
• POST /messages?sessionId=...

Verify an intent:

curl -s http://localhost:8788/v1/verify-intent \
  -H "Content-Type: application/json" \
  -d '{"intent":{"agentId":"agent_local","action":"fetch","target":"api.unknown-exfil.io","amount":1}}'

Set LIMITRUM_GATEWAY_API_KEY to require X-Limitrum-API-Key or Authorization: Bearer ....

See the main repository README for the full runtime-boundary workflow. See docs/AGENT_TOOL_FIREWALL.md for the product-level gateway pattern. See docs/HOSTED_GATEWAY.md for the HTTP gateway path. See docs/USE_WITH_AGENT_STACK.md for Claude/Cursor/provider setup.