Seatbelt MCP server
MCP runtime security proxy. Blocks dangerous AI agent tool calls with a policy engine.
3 stars75 downloads/wk
Reviews
Write oneNobody has reviewed Seatbelt yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Seatbelt tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.10 · 2026-11-04 · same rubric, same numbers if you re-run it
- Code scan94 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 93 days ago8/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How Seatbelt compares
Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 82/100
- higher than 65% of 4,456 AI and agents servers
- GitHub stars
- 3
- more than 73% of 2,733 AI and agents servers
- Downloads a week
- 75
- more than 51% of 1,712 AI and agents servers with a package
Install Seatbelt in Claude Code, Cursor or VS Code
Runs npx -y @kryptosai/mcp-seatbelt on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add mcp-seatbelt -- npx -y @kryptosai/mcp-seatbelt
What the publisher says
From the Seatbelt repository's README, as published. We do not edit it. Read it on GitHub
MCP Seatbelt — Runtime Guardrails for AI Agent Tools
Block dangerous MCP tool calls at the protocol layer. Scan, proxy, enforce.
Part of the MCP Security Platform. Scan before you trust with mcp-observatory (236★), then enforce at runtime with mcp-seatbelt. 📄 Read the technical whitepaper.
🌐 Website: kryptosai.github.io/mcp-seatbelt — demo, comparison, pricing
<!-- -->
The Problem
AI coding agents (Cursor, Claude, VS Code, ChatGPT, Windsurf, and others) connect to MCP servers that expose file systems, shell interpreters, network access, and environment variables. Static scanners tell you you're exposed — but they act after the fact. By the time a scanner flags a risky server, the agent may have already run a destructive command, exfiltrated credentials, or reached out to an untrusted endpoint.
MCP Seatbelt adds a runtime enforcement layer. It acts as a policy proxy between the agent and every MCP server, evaluating each JSON-RPC tool call against rules you control and denying dangerous requests before they reach the upstream. It does not operate at the TCP level — it inspects and gate-checks every call at L7 (the MCP protocol layer) before forwarding.
What It Does
Detection & Proxy
- Detects MCP configs across 8 clients — Automatically discovers MCP server configurations from Cursor, Claude Desktop, VS Code (user + workspace), ChatGPT Desktop, Codex, JetBrains IDEs (IntelliJ, PyCharm, WebStorm, etc.), Windsurf, and project-local files (.mcp.json, .mcp/config.json). No manual wiring required.
- Runtime proxy with policy enforcement — Starts a transparent JSON-RPC 2.0 proxy on port 9420. Every tool call, resource access, and prompt request is intercepted, evaluated against your policy, and allowed, denied, warned, or redacted. Three modes: default-deny (zero-trust), allowlist (whitelist known-good), and audit (log only, no blocking).
- 13 built-in risk rules — Covers shell interpreters (bash, sh, zsh, python, node), sandbox bypass (--no-sandbox, --disable-web-security), credential exposure in environment variables, Docker privileged containers, raw network tools (curl, nc, telnet), process spawning, destructive filesystem operations, remote URL access, risky package runners (npx, uvx), privilege escalation (sudo, chmod), and sensitive filesystem paths.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Grade history
- 2026-11-04downgradeA → Bscore 82
Seatbelt: common questions
- Is Seatbelt MCP server safe?
- Mostly: it is graded B (82/100). Read the Seatbelt safety report
- How do I install Seatbelt?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Seatbelt need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Seatbelt maintained?
- The last commit was 104 days ago (2026-08-04). The latest release is v0.7.0.
- What can I use instead of Seatbelt?
- Servers from other publishers that do the same job: agent-custody MCP server, Agent Security Scanner MCP server and HOL Guard MCP server.
- How does Seatbelt compare with other AI and agents MCP servers?
- safety score 82/100 (higher than 65% of 4,456 AI and agents servers); github stars 3 (more than 73% of 2,733 AI and agents servers); downloads a week 75 (more than 51% of 1,712 AI and agents servers with a package). Full comparison.
Alternatives to Seatbelt
Same job from other publishers: the closest match first, then the best rated.
- agent-custodyMCP gateway that checks each agent tool call against a signed grant and policy, and signs a receiptnot reviewedEstablishedA
- Agent Security ScannerSecurity layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.not reviewedEstablishedC
- HOL GuardLocal-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.not reviewedEstablishedA
Summer EngineThe game engine built for AI. Any agent makes a multiplayer game and publishes it.not reviewedEstablishedB- DCC-MCP CoreAgent control plane for DCC and engine hosts: one MCP endpoint, one tool contract.not reviewedEstablishedA
