LabscoMCP early access ↗
acuvityMCP SERVER · OFFICIAL PROJECT

Minibridge

Wrap an MCP server in TLS, policy checks and telemetry so you can safely put it somewhere other than localhost.

by acuvity ↗Agent Guardrails, Content Safety & Audit✓ Official

LABSCO SUMMARY

It adds no tools of its own; it changes what the server you already run is allowed to do.

The install is one line of config: swap your server's command for minibridge in all-in-one mode with that same command after a double dash, and the unmodified server now gets TLS, integrity checking and telemetry around it. Read the feature table before assuming more — secrets redaction, authorization controls and PII detection are marked as things you implement in Rego, not behaviour that ships turned on.

What it is

A Go binary that sits between an agent and an MCP server as a backend-to-frontend bridge: the frontend takes the client connection, the backend wraps the MCP server, and an optional Policer inspects what passes in either direction.

What you get

  • TLS on the wire, with optional client certificate validation
  • Tool integrity checks, so the wrapped server cannot mutate its tools or templates during execution
  • Policers that authenticate the user and inspect or transform content, written locally in OPA Rego or served remotely over HTTPS
  • SBOM generation and real-time validation of the MCP server
  • Prometheus metrics, plus OpenTelemetry traces that can pick up spans carried on the MCP call itself
  • An all-in-one mode that wraps an existing stdio server in a single process

Requirements

Install from Homebrew, the AUR, go install go.acuvity.ai/minibridge@latest, or a release binary. Your MCP client must be able to resolve the binary — if it reports a spawn error, put the full path from which minibridge in the command field. Policers are optional and are yours to write.

Setup effort

One command — go install go.acuvity.ai/minibridge@latest

See installation options