Aggrete
An MCP proxy that enforces a code-of-conduct document across connectors, with per-user memory that accumulates across calls.
Four individually-authorized questions can assemble a layoff list — no single one is sensitive, so no guardrail fires. Aggrete is the layer that catches the combination: is this call, together with everything this person already pulled today, something the code of conduct forbids?
Try it live — nothing to install · or uvx aggrete --demo
Install
pip install aggrete # or: uv tool install aggrete
uvx aggrete --demo # the walkthrough — no config, auth, or network
aggrete --config proxy.config.yaml # run it for real
The one example
The check tool dry-runs a plan and returns the verdict before anything is fetched:
Plan check: REFUSED.
1. hr__recent_joiners [hr-personnel] -> allowed
2. finance__budget_roles [finance-comp] -> allowed
3. ops__oncall_draft [ops-rota] -> REFUSED COC-HR-004
Personnel, compensation, and operational rosters may not be combined to
derive the planned departure of identifiable individuals.
Each call is fine alone. The third completes a forbidden set across three domains that overlap on the same people, so it's denied before the upstream call — the data is never fetched.
What it does
- Refuses before fetching, using a YAML policy and per-user memory across calls and sessions — not single-call authorization.
- Redacts emails, SSNs, cards, and tokens from results before they reach the model; hides walled tools from users who can't call them.
- Shields against prompt injection — any write after a session reads untrusted content is refused — and against tool poisoning, flagging hidden instructions in tool descriptions.
- Holds upstream credentials itself (confused-deputy safe), with optional per-user on-behalf-of access.
- Audits tamper-evidently — every decision is one hash-chained JSON line (
aggrete-audit), optionally forwarded to a SIEM. - Ask before you act —
checkpreviews any sequence,scenarioslists things to try.
Learn more
- Writing policy — the
coc.yamlschema, rule types,arg_match, and drafting from your handbook withaggrete-ingest - Deploying — architecture, the deploy matrix, HTTP + OAuth, connecting Claude, and per-user credentials
- Building a connector — expose read/write tools and govern any system (Google Drive is the reference)
- Roadmap — shipped, in progress, and planned
- Agent skill — teach Claude Code or any MCP client to set up and operate Aggrete:
/plugin marketplace add aggrete/aggrete, or readskill://aggrete/SKILL.mdfrom a running proxy
Honest limitations
- Post-call denial redacts, it does not un-fetch — prefer rules decidable pre-call.
- stdio identity is advisory — real enforcement needs streamable HTTP with OAuth and IdP-level blocking of direct connector grants, so the proxy is the only path.
- Aggregation can only be narrowed, not solved — a user who spaces requests beyond the window, or paraphrases across systems the proxy doesn't front, gets through. This raises the cost and creates the audit trail; it isn't a ceiling.
- Not a gateway — no multi-tenancy, token vault, or HA. For production, embed this engine in agentgateway or IBM ContextForge.
mcp-name: io.github.aggrete/aggrete
1 maintainer
Metadata
1 maintainer
Release files for aggrete 0.9.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| aggrete-0.9.0.tar.gz | 101.3 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| aggrete-0.9.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 198.3 kB
Release files / aggrete-0.9.0.tar.gz
| Download URL | aggrete-0.9.0.tar.gz |
|---|---|
| Size | 101.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b04c6054d87a6cd5e513ee5f524a0d153ecc84094d1db61203acbbba810a5215
|
|
BLAKE2b-256 checksum How to use checksums |
5c08cda25c2563d558a02e0d9333be53715af8ba635d3a2c3a48014789c6194d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 15, 2026.
Transparency logRelease files / aggrete-0.9.0-py3-none-any.whl
| Download URL | aggrete-0.9.0-py3-none-any.whl |
|---|---|
| Size | 97.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c25bced3bb96f95d81e67525c7daa00e8692256d4bb5976dfeaab98066c8789b
|
|
BLAKE2b-256 checksum How to use checksums |
c09deabd2bc0ea7bde20c33f3648b56710e2c5f660413dc9f7b8429253f2bec5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 15, 2026.
Transparency log
