provenyn-mcp

Every MCP tool call your agents make, checked against a passport before it runs and signed into a receipt afterwards — for MCP servers you run locally and ones that live at a URL.

One file, no dependencies, so it runs with nothing installed:

uvx provenyn-mcp --agent fs-agent -- npx -y @modelcontextprotocol/server-filesystem /path
uvx provenyn-mcp --agent linear-agent --url https://mcp.linear.app/mcp

Or pipx install provenyn-mcp. In the npm ecosystem the same gateway is npx -y @provenyn/mcp.

Governing what you already have

uvx provenyn-mcp wrap --dry-run   # show the diff, change nothing
uvx provenyn-mcp wrap --yes       # write it, after a timestamped backup
uvx provenyn-mcp doctor           # what is governed, what is not
uvx provenyn-mcp unwrap --yes     # put it all back

wrap rewrites the MCP client configs already on the machine — Claude Desktop, Cursor, VS Code, Windsurf, Claude Code — so every server in them runs through the gateway, with its own agent.

Configuration

PROVENYN_API_KEY is required. The gateway refuses to start without one, and refuses any tool call it cannot get an authorization decision for — it never fails open. Get a key at provenyn.com.