@mcpverify/bridge

Transparent MCP proxy that verifies tool integrity between AI agents and MCP servers.

What it does

Sits between your AI agent and an upstream MCP provider as a transparent stdio/SSE proxy. Intercepts tools/list responses and verifies them against cryptographic commitments. If tools have been tampered with, the bridge warns or blocks depending on mode. All verification events are logged to a tamper-evident hash chain.

Features

• Transparent proxy — stdio or SSE transport, zero config for the agent
• Schema verification — intercepts tools/list and checks against signed commitments
• Warn or strict mode — log tampering and continue, or block the tool entirely
• Trace context — injects distributed trace IDs into tools/call requests
• Trace shapes — learns structural patterns of tool calls for anomaly detection
• Audit logging — every verification event written to a hash-chained log

Install

npm install @mcpverify/bridge

Usage

stdio bridge (wrap a local MCP server)

npx mcpverify-bridge --cmd "node server.js" --dir ./verify-data --mode warn

SSE bridge (wrap a remote MCP server)

npx mcpverify-bridge https://api.example.com/mcp --dir ./verify-data --mode strict

Claude Desktop config

{
  "mcpServers": {
    "my-server": {
      "command": "npx",
      "args": [
        "mcpverify-bridge",
        "--cmd", "node",
        "--args", "server.js",
        "--dir", "./verify-data",
        "--mode", "warn"
      ]
    }
  }
}

Options

| Flag | Description | |------|-------------| | --cmd <command> | Upstream server command (stdio mode) | | --args <a,b,c> | Comma-separated args for the command | | --env <K=V,K=V> | Extra environment variables | | --dir <path> | Directory for commitments, keys, and audit chain | | --mode <warn\|strict> | warn logs mismatches, strict blocks them | | --server-id <id> | Server identifier for registry lookups |

How it works

1. Agent connects to the bridge via stdio
2. Bridge connects to the upstream MCP server (stdio or SSE)
3. On tools/list response, bridge verifies tool schemas against stored commitments
4. On tools/call request, bridge injects trace context for distributed tracing
5. All events logged to the tamper-evident audit chain

Learn more

mcpcerts.com

License

MIT