fastmcp-dominion

Trust-gated MCP middleware for FastMCP via Dominion Observatory.

Automatically verifies MCP server trust scores before allowing tool calls. Blocks untrusted servers, caches lookups, and provides configurable failure modes.

Installation

pip install fastmcp-dominion

Quick Start

from fastmcp import FastMCP
from fastmcp_dominion import TrustMiddleware

app = FastMCP("my-server")
app.add_middleware(TrustMiddleware(threshold=70))

That's it. All incoming tool calls are now verified against Observatory's behavioral trust scores from 14,800+ MCP servers.

Configuration

from fastmcp_dominion import TrustMiddleware, TrustConfig

config = TrustConfig(
    threshold=70.0,         # Minimum trust score (0-100)
    cache_ttl=300,          # Cache scores for 5 minutes
    fail_mode="open",       # "open" = allow on API error, "closed" = block
    log_decisions=True,     # Log trust check decisions
    bypass_tools=["ping"],  # Tools that skip verification
)

app = FastMCP("my-server")
app.add_middleware(TrustMiddleware(config=config))

Synchronous Usage

For scripts or non-async code:

from fastmcp_dominion.middleware import check_trust_sync

result = check_trust_sync("https://some-mcp-server.com/mcp")
print(f"Trust score: {result['trust_score']}")
print(f"Passed: {result['_passed']}")

How It Works

1. Incoming MCP request arrives
2. Middleware extracts the server URL from request headers/metadata
3. Queries Observatory's trust API (cached for 5 min by default)
4. If score >= threshold: request proceeds normally
5. If score < threshold: returns JSON-RPC error with trust details
6. If Observatory unreachable: behavior depends on fail_mode

API

Observatory tracks 14,800+ MCP servers with behavioral trust scores based on real interaction data. Free tier: 50 queries/day.

• Trust API: GET https://dominionobservatory.com/api/trust?url=<server_url>
• Docs: https://dominionobservatory.com
• GitHub: https://github.com/sgdata-io/dominion-observatory

License

MIT