cMCP, short for Confidential MCP Runtime, provides a secure and confidential approach to running the MCP (Managed Control Plane). This open-source gateway enforces tool-call policies inside a hardware Trusted Execution Environment (TEE), ensuring that the agent it governs cannot access it.

Key Features

• Secure Policy Enforcement: Every tool call is intercepted and evaluated against a Cedar policy bundle. Decisions are enforced in a TEE, offering a robust security layer that prevents unauthorized access or tampering by potentially malicious actors.
• Tamper-Evident Claims: After each session, a signed TRACE Claim is generated, providing verifiable proof of which tools executed, the policy decisions made, and a complete audit trail that does not require trust in the operator.

The Challenge Addressed

Software-only governance methods cannot guarantee that the policy engine itself is secure. Potential vulnerabilities include:

• Compromised Policy Bundles: An unauthorized admin could alter the Cedar policy after validation, leading to unregulated tool calls.
• Memory-based Manipulation: Attacks could change policy decisions within the same address space, rendering decisions potentially unreliable.
• Unreliable Audit Trails: The audit log may not accurately reflect the actions taken during operation, allowing for retrospective manipulation of logs by any party with access to the signing key.

cMCP mitigates these risks by running its policy engine within a TEE, where it is protected from the processes it governs. The policy bundle hash is securely measured into the hardware attestation report prior to execution, making the system resilient against common attack vectors.

Usage Example

Start utilizing cMCP with minimal setup to solidify tool-call policies and generate TRACE Claims:

pip install cmcp-runtime

Create a configuration file, cmcp-config.yaml, and specify your desired options:

attestation:
  provider: auto # automatically selects the best available TEE provider
  enforcement_mode: advisory # adjust as needed: enforcing or silent modes available
policy_bundle_path: ./policies/
catalog_path: ./catalog.json

Start the gateway to begin enforcing policies:

CMCP_DEV_MODE=1 cmcp start --config cmcp-config.yaml

How It Works

1. Agents send tool calls to the cMCP Gateway rather than directly to the MCP.
2. At launch, the gateway validates the Cedar policy bundle.
3. Each tool call undergoes evaluation within the TEE, leading to a decision of allow, deny, or redact.
4. Upon session completion, a TRACE Claim is produced, signed securely and traceable back to the original tool calls.

For comprehensive documentation, including details on configuration, enforcement modes, and supported TEE providers, please visit the official documentation.

Security Standards Compliance

cMCP aligns with several security standards, ensuring that implemented solutions adhere to recognized security principles and practices.