Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

MCP-gateway enforcement surface: raise MCP-capable agents above advisory

Open
  • Is something wrong?
#32 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
28/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
python
Domain
devtools, security

Research direction

Start by reading compile/surfaces.py and docs/enforcement-surfaces.md to settle how mcp-gateway relates to the existing gateway reservation. For P3a, audit which agents support project-scoped MCP configuration and produce the gate-kind-by-surface mapping before any emitter work. Done means the naming, witnessable agent slice, and honest enforcement mapping are documented; the issue describes later implementation phases separately.

Written by the indexing model from the issue text.

Description

help wanted roadmap

The gap

Pre-tool-use blocking covers two agents today (Claude Code, Cursor). Most of the remaining eleven cannot be hooked natively -- but many of them speak MCP. Their MCP tool calls can route through a local, Chock-governed proxy that evaluates each call against the repo's compiled gates before forwarding it.

This is also the enforcement vehicle for the Agent Plugins open standard: that format packages only skills and MCP servers, so today our agent-plugins tree is advisory-only. A gateway shipped as the package's MCP server upgrades the open format to carry deterministic enforcement -- agent-agnostically, without waiting for the spec to grow a hook API.

Naming: mcp-gateway, not gateway

Surface.GATEWAY already exists in compile/surfaces.py, reserved in docs/enforcement-surfaces.md for budget/egress backstop controls. This surface is a different thing: call it mcp-gateway. (Alternative: merge the two reservations -- decide before P3b, not after.)

Honest scope -- what actually rises

The gateway governs MCP-routed tool calls only. The agent's native tools (Copilot's shell, Gemini's file edits) never cross it. Consequences:

  • Shell-text guards (block-destructive-commands, block-no-verify, protect-agent-config) do NOT rise for agents without native hooks. Claiming otherwise fails the do-not-claim list.
  • What rises: policies expressible as MCP-call predicates -- file writes through MCP filesystem servers, network egress through fetch-type servers, tool-scope restriction, parameter inspection on MCP-backed databases/APIs.
  • First deliverable is therefore a gate-kind x surface mapping: which compiled gate kinds can honestly bind at mcp-gateway. No emitter work before that table exists.
  • Per-package claim vocabulary: enforced for MCP tool traffic, advisory for native tools -- stated in every emitted description, same convention as the Cursor caveat.

Two shapes, only one is enforcement

  • A policy packaged as an MCP tool the agent may call (verify_compliance) is advisory-plus: the agent can decline to call it. Not this issue.
  • A gateway: the client's MCP config lists the proxy as its server; the proxy wraps the real downstream servers (aggregator -- one proxy, many upstreams) and vetoes calls against compiled gates. That is the surface.

Witness rule (coverage honesty)

enforced requires BOTH: the gateway verifiably installed AND the committed MCP client config routes through it exclusively -- a config listing other servers alongside the gateway has an ungoverned route and stays advisory. User-level config outside the repo can still add direct servers; that boundary is stated, same as the git-hooks arm-on-clone boundary.

Fail posture

A stdio proxy spawned by the client fails closed by nature: proxy dead means MCP calls error. First surface where fail-closed comes free -- document it as such, plus the availability consequence.

Implementation notes (P3b)

  • Stdlib-only Python, vendored like the gate runner; reuses the compiled gate evaluators -- no fresh string matching (position-blind token parsing is exactly catalog#11's bug class).
  • JSON-RPC interception over stdin/stdout; line buffering (bufsize=1) + explicit flush, or the pipe deadlocks.
  • Aggregator from day one: the exclusivity witness requires wrapping multiple downstream servers.

Phasing

  • P3a (spec, no code): settle the name; audit which of the 13 agents are MCP-capable with project-scoped MCP config (the witnessable slice); write the gate-kind mapping.
  • P3b: stdio proxy MVP governing 2-3 honest gate kinds, evals included.
  • P3c: per-agent config emitters + witnesses; tiers rise agent-by-agent. Agent-plugins packages gain an mcpServers gateway entry; marketplace descriptions carry the split claim.

Distribution follow-on

Once shipped, submit Chock to the MCP ecosystem registries/directories as governance middleware -- a channel the launch plan does not yet cover.

Dominant language
Python
Stars
8
Forks
1
Avg merge
2h 48m
Merged PRs (30d)
114

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from open-coder-ai/chock

All issues in open-coder-ai/chock

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.