AtlaSent MCP Server

@atlasent/mcp-server

MCP server that enforces authorize-before-execute for any MCP-compatible AI agent.

It is the developer entry point to AtlaSent AI Action Protection, which Enterprise teams adopt through a design partner program.

AtlaSent is security and organizational authority infrastructure for consequential actions by people, software, and AI.

This MCP server brings it to AI agents (Claude, Cursor, Windsurf, any MCP host). Before an agent's tool call changes a real system (a production deploy, a data export, an access grant), the agent asks AtlaSent first. With an API key (remote mode):

1. Connect it to your agent with a few lines of config.
2. Risky actions wait for a person to approve them. Everything else runs as normal.
3. Every decision gets a signed record, including who approved it when the decision relied on an approval.

Try it in 60 seconds with no account: npx -y @atlasent/mcp-server (local mode, a demo that protects nothing).

Local blocking is free. To actually block on your own machine without an account, use MCP Gate or the Claude Code agent guard. Both are part of the free Community plan. Hosted decisions, shared policies and approvals for a team are on the AtlaSent plans.

For engineers

AtlaSent performs execution-time authorization: determine whether a specific consequential Action is authorized now, issue a bounded Permit on allow, verify that Permit at the execution Gate, and only then allow the governed native effect.

A plausible request is not organizational authority.

This MCP server exposes AtlaSent authorization primitives to Model Context Protocol hosts and includes a protected deployment demo that proves the ordering end to end.

Which authority decided?

This repository ships two packages, and one of them has two modes. All three block tool calls. Only one of the three is evidence, and the difference is not a feature list — it is who said yes.

A rule you can silently edit is configuration. A permit your organization issued, that was consumed once and can be produced later, is authority. Both stop the call; only the second answers "who authorized this?" — which is the question that arrives after an incident, not before one.

The gate says which one decided, on every decision: nomatchingrule is your local policy, cloudpermitconsumed is an organizational permit. These reason strings are deliberately not normalised into a generic "blocked." Do not collapse them.

Shortened. The full README is on GitHub.