Broker
MCP Gateway
Every Model Context Protocol server an agent can reach is registered, versioned, and inspected. Tool definitions are pinned, so a server that changes what a tool does cannot silently change what your agents are able to do.
The problem
Each MCP server is a separate trust boundary, added by whoever needed it, updated by someone else. A tool description is model-facing instruction text — and it is supplied by the server, not by you.
Capabilities
How MCP Gateway works
- 01
Registry with pinned definitions
Tool schemas and descriptions are captured on approval. A drifted definition is flagged and held for review rather than taking effect.
- 02
Description-as-instruction inspection
Tool descriptions are treated as untrusted input and screened for instruction-shaped content, because they enter the model's context with the authority of a system message.
- 03
Per-agent tool scoping
A server exposing thirty tools can be exposed to a given agent as three. Scope is declared centrally, not negotiated per client config.
- 04
One connection point
Agents connect to Cirvix; Cirvix connects to servers. Credentials, allowlists, and rate limits are enforced in one place instead of in every client's config file.
In practice
What it looks like
$ cirvix gateway --servers ~/.cursor/mcp.json --policy cirvix.policy.json [cirvix] gateway up · 2 upstream · 11 rules · local policy [cirvix] github: 12 tools pinned permit mcp.github.repo_read owner/repo 0.3ms permit mcp.github.issues_comment owner/repo#4821 0.3ms deny mcp.github.repo_admin owner/repo 0.2ms └─ deny-github-admin [cirvix] github.repo_admin: definition changed since it was pinned. Withheld from tools/list until a person reads the diff.Limits
What this does not do
- Pinning detects change; it does not judge intent. A legitimate upstream improvement and a hostile edit both surface as drift and both require a human to look.
- A server can only be governed if agents reach it through the gateway. A directly configured server bypasses this module, which is why `cirvix scan` reports unmanaged servers it finds on the machine.
Get started
Let the agents do real work.
Start with the free local scanner — it needs no account and tells you what is already ungoverned on your machine. Move to a governed runtime when you are ready.
Cirvix AgentControl is in private beta. Pricing is published and plans are not yet chargeable — early access confirms your place and we will tell you before anything bills.