MCP Hangar

The policy enforcement plane for MCP -- deterministic admission and egress policy, attributable audit, and SIEM export for your MCP server fleet. MIT, self-hosted, no SaaS.

PyPI CI License: MIT

Why

In MCP, the tool list is a hint the client caches; the call path is the only surface a provider mediates in real time. Every governance primitive worth having -- revocation, per-tenant scoping, audit -- attaches there, or attaches to nothing. Hangar puts a policy enforcement plane on that seam: one mediated path for lifecycle, policy, and telemetry across your whole MCP server fleet.

Background: The Advisory List -- Why MCP Governance Lives at the Call Path

Install

pip install mcp-hangar
# or: uv pip install mcp-hangar

This resolves to 2.0.0. Coming from 1.6.x, read the upgrade guide first — two of the changes need a decision before you upgrade, not after: Slack approval delivery now needs an adapter you run yourself, and approval resolution is authorized. Your upstream MCP servers do not have to move; a connection that negotiates the 2025-11-25 protocol keeps working. To stay on the old line while you plan, pin "mcp-hangar>=1.6,<2" — note that it is closed and receives no fixes.

Quickstart

Point Hangar at an MCP server in config.yaml:

mcp_servers:
  github:
    mode: subprocess
    command: [uvx, mcp-server-github]
    env:
      GITHUB_TOKEN: ${GITHUB_TOKEN}

Then serve it:

mcp-hangar serve --config config.yaml                     # stdio (Claude Desktop)
mcp-hangar serve --config config.yaml --http --port 8000  # HTTP + REST API at /api/

Hangar refuses to bind a non-loopback interface without auth. For a quick/insecure demo, pass --unsafe-no-auth; for anything real, configure the auth block.

Or skip the config entirely -- get filesystem, fetch, and memory servers wired into Claude Desktop in one line:

curl -sSL https://mcp-hangar.io/install.sh | bash && mcp-hangar init -y && mcp-hangar serve

What you get

The enforcement plane — what the call path actually decides:

  • L7 egress policy -- allow/deny in MCP semantics: which upstream, which tool, which arguments. Deterministic, with no anomaly scores and no learned baselines, so every verdict is reproducible from the policy that produced it.
  • Tool-schema digest pinning -- an upstream that changes a pinned tool's schema fails closed instead of quietly serving a different tool. Pin for every caller with tool_projection.pins, or per tenant, which needs authentication so a caller arrives carrying one.
  • Auth & RBAC -- API-key and OIDC/JWT identity with role-based access and RFC 8707 audience binding; bootstrap the first administrator with mcp-hangar auth bootstrap-admin, and every call carries a verified principal into the audit trail.
  • Per-tenant tool projection -- front-door mode presents a different executable surface per caller, fail-closed on unknown identity.
  • Human-in-the-loop approvals -- gate a call on an explicit decision, authorized and attributed to a real principal. Delivery channels are pluggable; core ships no vendor integration.
  • Governed task relay -- Hangar interposes on the SEP-2663 task lifecycle and never becomes an executor: no scheduler, no job runner, no result store.
  • Attributable audit -- an identity-attributed audit record exported to SIEM as CEF, LEEF 2.0, RFC 5424 syslog or JSON-lines, and to OTLP.

Everything else it takes to run a fleet:

  • Parallel tool calls -- one hangar_call fans out to many MCP servers concurrently; all results returned together.
  • Lifecycle management -- lazy start, health checks, single-flight cold starts, idle shutdown, and per-server circuit breaking.
  • Hot config reload -- add or withdraw servers and tools via file watch, no restart.
  • OAuth ingress -- advertise as an RFC 9728 protected resource and challenge external agents for verified tokens.
  • Observability built in -- OpenTelemetry traces, Prometheus metrics, and structured logs.

One config gotcha: tools: is overloaded

The per-server tools: key accepts two forms that look similar and mean opposite things:

tools:                        # LIST -- pre-start visibility projection
  - name: add
    inputSchema: { type: object, properties: { a: { type: number } } }

tools:                        # DICT -- access policy
  allow: [create_issue, list_issues]
  deny: [delete_repository]

The list form only lets a tool be listed before its provider has started. It is not an access policy, and it does not survive startup: the provider's dynamic tools/list is authoritative and replaces it entirely, so a statically-listed tool the provider does not return becomes uncallable and fails with Tool not found: <name> at invocation.

The dict form is the access policy — glob patterns, three-level merge. Reach for it when you mean to restrict something. Full semantics in the configuration reference.

Documentation

License

MIT

Project links

Data verified by PyPI on Aug 11, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2.17.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for mapyr from gravatar.com mapyr

Credits

Author: Marcin Pyrka

GitHub Statistics

Data verified by PyPI on Aug 11, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT License (MIT)

Requires

Python >=3.11

Provides Extra

containers dev full kubernetes langfuse opentelemetry postgres

Tags

ai infrastructure llm mcp model-context-protocol

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

mcp_hangar-2.6.0.tar.gz (2.4 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

mcp_hangar-2.6.0-py3-none-any.whl (1.1 MB view details)

Uploaded Python 3

File details

Details for the file mcp_hangar-2.6.0.tar.gz.

File metadata

  • Download URL: mcp_hangar-2.6.0.tar.gz
  • Upload date:
  • Size: 2.4 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for mcp_hangar-2.6.0.tar.gz
Algorithm Hash digest
SHA256 d71040c7057e52e9117222d60ba9de00b4d482ad30f41caaf9f520780cbe48e1
MD5 1eb4bd1d42c9acd74c3ef508bf28e621
BLAKE2b-256 dc2fb908f27a0c3080cbb2bb4a638bb7ab95fe1ce1d10e7213a3050edb285ce5

See more details on using hashes here.

Provenance

The following attestation bundles were made for mcp_hangar-2.6.0.tar.gz:

Publisher: release.yml on mcp-hangar/mcp-hangar

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file mcp_hangar-2.6.0-py3-none-any.whl.

File metadata

  • Download URL: mcp_hangar-2.6.0-py3-none-any.whl
  • Upload date:
  • Size: 1.1 MB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for mcp_hangar-2.6.0-py3-none-any.whl
Algorithm Hash digest
SHA256 44cc5cb890fd5c81d666c759b584adc78517a706b5000c661dc33cee251daaac
MD5 a6c0ebf35223e5d7937cfe5ed29e6c64
BLAKE2b-256 2da63c9fb9f5ba7e0c929b14de1e46c22f2c1695cfdd5539e3483233cef8c116

See more details on using hashes here.

Provenance

The following attestation bundles were made for mcp_hangar-2.6.0-py3-none-any.whl:

Publisher: release.yml on mcp-hangar/mcp-hangar

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

2.17.0

2 files

2.16.0

2 files

2.15.0

2 files

2.14.1

2 files

2.14.0

2 files

2.13.1

2 files

2.13.0

2 files

2.12.0

2 files

2.11.0

2 files

2.10.1

2 files

2.10.0

2 files

2.9.0

2 files

2.8.0

2 files

2.7.0

2 files

This release

2.6.0 This release

2 files

2.5.3

2 files

2.5.2

2 files

2.5.1

2 files

2.5.0

2 files

Pre-release

2.5.0rc4

2 files

Pre-release

2.5.0rc3

2 files

Pre-release

2.5.0rc2

2 files

Pre-release

2.5.0rc1

2 files

2.4.0

2 files

2.3.0

2 files

2.2.1

2 files

2.2.0

2 files

2.1.1

2 files

2.1.0

2 files

2.0.1

2 files

2.0.0

2 files

Pre-release

2.0.0rc4

2 files

Pre-release

2.0.0rc3

2 files

Pre-release

2.0.0rc2

2 files

Pre-release

2.0.0rc1

2 files

Pre-release

2.0.0a2

2 files

Pre-release

2.0.0a1

2 files

1.6.3

2 files

1.6.2

2 files

1.6.1

2 files

1.6.0

2 files

1.5.1

2 files

1.5.0

2 files

1.4.0

2 files

1.3.0

2 files

1.2.3

2 files

1.2.2

2 files

1.2.1

2 files

1.2.0

2 files

1.1.0

2 files

1.0.3

2 files

1.0.2

2 files

1.0.1

2 files

1.0.0

2 files

0.12.0

2 files

0.11.0

2 files

0.9.0

2 files

0.8.0

2 files

0.6.7

2 files

0.6.3

2 files

0.6.2

2 files

0.6.1

2 files

0.6.0

2 files

0.5.0

2 files

0.4.0

2 files

0.3.1

2 files

0.2.3

2 files

0.2.1

2 files

0.2.0

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

0.1.1

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page