Derbent MCP server

Derbent

One guarded pass for all your coding agents.

Every tool call that reaches Derbent, MCP or a CLI's built-in tools, is decided by one policy and written to a tamper-evident log, and the calls you care about wait for you.

Derbent guards against mistakes and prompt injection, and keeps an audit trail. It is not a sandbox: an agent that can already run shell commands as you can get around it (see Limits).

In Turkish history, a derbent was a guarded post on a mountain pass: its keepers decided who went through and kept a record of everyone who did. Derbent does the same for your coding agents' tool calls.

Claude Code, Codex, GitHub Copilot CLI and Antigravity CLI connect to Derbent as one MCP server, and your other MCP servers sit behind it. Each CLI's pre-tool hook sends its built-in tools, such as the shell and file edits, through the same gate. Every call is decided by your rules and written down.

Support for Codex and Antigravity CLI is experimental (configured from their docs, not yet checked in a real session).

It is one binary for Windows, macOS and Linux. There is no daemon and no network listener: a SQLite file is the only shared state (ADR 0001).

What you get

apply to MCP tools and to built-in tools such as the shell, in all four CLIs, and a repository can add project rules that only make them stricter.

• Rules that allow, deny or ask, by agent, tool and argument. The first match wins. The same rules

after 50 seconds by default.

• Approvals. A call your rules ask about waits until you press a in the terminal UI, or is denied

where the chain breaks after one was edited, moved, inserted or removed. Keep the head hash it prints to catch the newest ones being deleted too.

• Receipts. Every call gets a hash-chained receipt, and derbent verify names the first receipt

Also:

• Shared memory and handoffs. Agents keep notes per repository and can leave tasks for each other.
• Pins hold back a downstream server's tool when its definition changes.
• Budgets stop an agent stuck in a loop.

Install

Download the binary for your system and SHA256SUMS from the latest release, check the hash, and put it on your PATH as derbent (derbent.exe on Windows):

# Linux on amd64; the other files differ only in the end of the name
curl -LO https://github.com/tunahanaliozturk/derbent/releases/download/v1.0.0/derbent-v1.0.0-linux-amd64
curl -LO https://github.com/tunahanaliozturk/derbent/releases/download/v1.0.0/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
install -m 755 derbent-v1.0.0-linux-amd64 ~/.local/bin/derbent

Or build it with Go 1.27 or later:

go install github.com/tunahanaliozturk/derbent/cmd/derbent@latest

Homebrew (brew install tunahanaliozturk/tap/derbent) and Scoop install it too; see Install and set up.

Shortened. The full README is on GitHub.