The install is one line of config: swap your server's command for minibridge in all-in-one mode with that same command after a double dash, and the unmodified server now gets TLS, integrity checking and telemetry around it. Read the feature table before assuming more — secrets redaction, authorization controls and PII detection are marked as things you implement in Rego, not behaviour that ships turned on.
A Go binary that sits between an agent and an MCP server as a backend-to-frontend bridge: the frontend takes the client connection, the backend wraps the MCP server, and an optional Policer inspects what passes in either direction.
- TLS on the wire, with optional client certificate validation
- Tool integrity checks, so the wrapped server cannot mutate its tools or templates during execution
- Policers that authenticate the user and inspect or transform content, written locally in OPA Rego or served remotely over HTTPS
- SBOM generation and real-time validation of the MCP server
- Prometheus metrics, plus OpenTelemetry traces that can pick up spans carried on the MCP call itself
- An all-in-one mode that wraps an existing stdio server in a single process
Install from Homebrew, the AUR, `go install go.acuvity.ai/minibridge@latest`, or a release binary. Your MCP client must be able to resolve the binary — if it reports a spawn error, put the full path from `which minibridge` in the command field. Policers are optional and are yours to write.
One command — go install go.acuvity.ai/minibridge@latest