Watchlight MCP Runtime PEP

A Policy Enforcement Point for the Model Context Protocol. It sits in front of an upstream MCP server and makes one guarantee:

No governed MCP action reaches the target system until Watchlight has made a deterministic runtime authorization decision — and only an explicit PERMIT forwards it.

Every tools/call is authorized in-process by the real Watchlight engine before it can reach the upstream server. A denied call is blocked before it executes — not detected after. Zero infrastructure: no database, no network hop, no sidecar.

Install

pip install watchlight-mcp

Run

import watchlight_mcp

watchlight_mcp.serve(
    listen_addr="127.0.0.1:9700",
    upstream_url="http://localhost:3000/mcp",   # the MCP server you are governing
    upstream_server="github",                    # a stable name for it (used in policy + audit)
    policy_files=["policies/allow-read.json"],   # Cedar policies, wl-apdp shape
    audit_path="audit/mcp-pep.jsonl",            # value-free JSONL audit (omit → logs)
)

Point your MCP client at http://127.0.0.1:9700/mcp instead of the server directly. Governed tools/calls are authorized; everything else is forwarded transparently.

What it enforces

• MCP 2026-07-28 Streamable HTTP: the JSON-RPC body is authoritative, and the Mcp-Method / Mcp-Name / MCP-Protocol-Version routing headers are validated against it — a spoofed header cannot route a governed call around enforcement.
• Fail-closed: a deny, a runtime error, a malformed body, a header/body mismatch, or an unsupported protocol version all block the action. The upstream is contacted only on an explicit permit.
• Value-free audit: the audit record has no field for tool arguments, tokens, or credentials — only the decision and safe correlation ids.

Identity

The PEP reads client-asserted Watchlight-* headers (Watchlight-Agent-Id, Watchlight-Execution-Id, …) to build the authorization principal and execution context — the Developer-Edition trust model. Without an attributed agent, the action is denied by default.

© Watchlight AI. The embedded runtime is proprietary; see LICENSE.