Aggrete MCP server

Aggrete

An MCP proxy that enforces a code-of-conduct document across connectors, with per-user memory that accumulates across calls.

Four individually-authorized questions can assemble a layoff list — no single one is sensitive, so no guardrail fires. Aggrete is the layer that catches the combination: is this call, together with everything this person already pulled today, something the code of conduct forbids?

Try it live — nothing to install · or uvx aggrete --demo

Install

pip install aggrete                 # or: uv tool install aggrete
uvx aggrete --demo                  # the walkthrough — no config, auth, or network
aggrete --config proxy.config.yaml  # run it for real

The one example

The check tool dry-runs a plan and returns the verdict before anything is fetched:

Plan check: REFUSED.
  1. hr__recent_joiners     [hr-personnel]  ->  allowed
  2. finance__budget_roles  [finance-comp]  ->  allowed
  3. ops__oncall_draft      [ops-rota]      ->  REFUSED   COC-HR-004
     Personnel, compensation, and operational rosters may not be combined to
     derive the planned departure of identifiable individuals.

Each call is fine alone. The third completes a forbidden set across three domains that overlap on the same people, so it's denied before the upstream call — the data is never fetched.

What it does

• Refuses before fetching, using a YAML policy and per-user memory across calls and sessions — not single-call authorization.
• Redacts emails, SSNs, cards, and tokens from results before they reach the model; hides walled tools from users who can't call them.
• Shields against prompt injection — any write after a session reads untrusted content is refused — and against tool poisoning, flagging hidden instructions in tool descriptions.
• Holds upstream credentials itself (confused-deputy safe), with optional per-user on-behalf-of access.
• Audits tamper-evidently — every decision is one hash-chained JSON line (aggrete-audit), forwarded to a SIEM or an OpenTelemetry collector, with Prometheus metrics and health endpoints for operations.
• Ask before you act — check previews any sequence, scenarios lists things to try.
• Hold for a human — action: approve pauses a call until the clause owner approves it, from Slack, the terminal, or the console; the approval is a time-limited, audited grant.

Learn more

Shortened. The full README is on GitHub.