SafeNode MCP Gateway MCP server

SafeNode MCP Gateway

An MCP proxy that enforces policy on every tool call. The agent cannot route around it.

npx safenode-mcp-gateway

Why a proxy

An MCP server that exposes an evaluate_action tool is theatre. The model can choose not to call it, which means it enforces nothing.

This is a proxy. It sits between your MCP client (Claude Desktop, Claude Code, Cursor, any MCP host) and the MCP servers you already use. tools/list passes straight through, so the model sees exactly the tools it saw before. Every tools/call is evaluated against SafeNode first. A denial means the call never reaches the downstream server at all.

Claude Desktop ──► safenode-mcp-gateway ──► filesystem server
                          │                   github server
                          ▼                   postgres server
                    SafeNode API
                  allow/warn/review/deny

Your agent needs no code changes. It does not know the gateway is there.

Get an API key — free tier, no card · Docs · Python SDK

Setup

1. Get an API key

Free at safenode.tech. Keys look like sn_....

2. Write a config

safenode-gateway.json — take the servers straight out of your existing MCP client config:

{
  "failMode": "fail_closed",
  "payloadMode": "redacted",
  "logFile": "./safenode-decisions.jsonl",
  "servers": [
    {
      "name": "filesystem",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/you/projects"]
    }
  ],
  "tools": {
    "read_file": { "failMode": "fail_open" },
    "write_file": { "payloadMode": "metadata_only" }
  }
}

Do not put your API key in this file. Set SAFENODEAPIKEY in the environment — it takes precedence over the config, so the file stays safe to commit.

3. See what would be sent, before sending anything

SAFENODE_API_KEY=sn_... npx safenode-mcp-gateway --dry-run

Prints the exact JSON body that an evaluation would POST. No network call. This is the fastest way to satisfy yourself about what leaves your machine.

4. Point your MCP client at the gateway

Claude Desktop — claudedesktopconfig.json:

{
  "mcpServers": {
    "safenode": {
      "command": "npx",
      "args": ["-y", "safenode-mcp-gateway", "--config", "/absolute/path/to/safenode-gateway.json"],
      "env": { "SAFENODE_API_KEY": "sn_..." }
    }
  }
}

Claude Code — .mcp.json in your project:

{
  "mcpServers": {
    "safenode": {
      "command": "npx",
      "args": ["-y", "safenode-mcp-gateway", "--config", "./safenode-gateway.json"],
      "env": { "SAFENODE_API_KEY": "sn_..." }
    }
  }
}

Cursor — ~/.cursor/mcp.json, same shape as Claude Desktop.

Replace your existing server entries with this one. The gateway spawns them itself, so listing them in both places would run each server twice.

What each decision does

Denials come back as MCP tool errors, not transport failures, so the model sees why and can try something else instead of the host surfacing an opaque crash.

Fail behaviour

failMode decides what happens when SafeNode itself is unreachable.

Shortened. The full README is on GitHub.