hmcp-gateway: default-deny MCP gateway that holds every write or delete for human approval
Aoutix · reddit · 2026-11-07
A developer argues MCP is structurally unsafe: one config line lets an agent call every tool on a server, including destructive ones; tool descriptions written by server authors are treated as instructions; risk labels come from the server itself; and there's no audit trail afterward.
hmcp-gateway sits between agent and servers, speaking standard MCP on both sides:
- Reads pass through; writes/sends/deletes are held until a human approves the exact arguments
- Newly added tools are unreachable until a human classifies them and a policy stub is generated
- Pattern-based injection detection is explicitly positioned behind the structural controls
- Honest limitations: the audit chain is tamper-evident, not tamper-proof; stdio upstreams bypass the egress allowlist
A browser demo shows six requests through the gateway vs direct, including refusing a delete. Not yet open-sourced; the author is soliciting feedback from MCP operators on whether human approval would break workflows and what attacks they actually fear.
More from coding & agent
- Power User Spending 12-16 Hours Daily Argues Creativity, Not Models, Is the Bottleneck — tengyanAI · 2026-11-07
- Hugging Face Turns Reasoning Models into Agents with RL and LoRA Adapters — yb2698 · 2026-11-07
- Doki lets you make videos with no timeline — just write the whole thing as one story — thesephist · 2026-11-07
- UniGFM-RAG paper trains the graph retriever and LLM end-to-end for GraphRAG — JeremyCMorgan · 2026-11-07
- Dev controls coding agent via Rokid smart glasses to ship Black Friday campaign — yihui_indie · 2026-11-07
- Claude auto-renders 21k Blender images to train a model that recreates your LEGO build — nptacek · 2026-11-07