cMCP: Confidential MCP Runtime
An open-source gateway that enforces Model Context Protocol tool-call policy inside a hardware trusted execution environment, so a governed agent process cannot alter or bypass its own policy engine.
cMCP intercepts every MCP tool call an agent makes, evaluates it against a Cedar policy bundle, and enforces the decision from a control plane the governed process cannot reach, running inside a Trusted Execution Environment when available or in a signed-only software mode otherwise. Each session produces a signed TRACE Claim, a tamper-evident record that a separate verifier can check without having to trust the operator running the gateway.
The project targets a specific weakness in software-only policy enforcement: an administrator or a compromised evaluator process can swap a policy bundle or flip an allow or deny decision in memory without leaving reliable evidence. cMCP is described as a developer preview launched at the Confidential Computing Summit, installable as a Python package and runnable in software mode without special hardware.