Rate limits, a path jail and confirmation prompts only mean something when a model cannot talk around them, and putting them in the transport is what makes that true. The startup design is worth knowing: it answers the handshake immediately and connects downstream servers in parallel, so a slow server delays its own tools rather than the whole session, with a listChanged notification when it catches up.
A local-first proxy that sits between your MCP client and the servers you already run. The client sees one entry, Spine holds the downstream connections, and every call passes through security policy, routing, schema minification and audit on the way through.
- Semantic routing: only the relevant tools are sent to the model, using local embeddings with no API calls; `spine_set_context` switches context explicitly
- Schema minification at four aggression levels — level 2 is reported at 61% token savings on tool schemas
- A token budget with a daily limit, a warn threshold and a warn-or-block action; `spine_budget` checks usage mid-conversation
- Human-in-the-loop: mark a tool `require_confirmation` and Spine pauses, shows the arguments and waits, with `spine_confirm` and `spine_deny` relaying your decision
- Prompt-injection scanning of tool responses before they reach the model, with a log, strip or block action
- Security policy: secret scrubbing, per-tool and global rate limits, a symlink-aware path jail with deny patterns for .env, .key and .pem, and an HMAC-fingerprinted SQLite audit trail
- `spine_recall` reads a ring buffer of recent tool results, so context is not lost when routing swaps tools between turns
- A web dashboard on localhost:8777 with live stats, latency per server and a full request log
The Python package `mcp-spine`, version 0.2.5, with the entry point `mcp-spine`. Install with `pip install mcp-spine`, or `pip install mcp-spine[ml]` to enable semantic routing. Run `mcp-spine init` for the setup wizard, `mcp-spine doctor --config spine.toml` to check it, then replace your individual client entries with one Spine entry pointing at `spine.toml`. Downstream servers, their commands and the audit database path require a restart to change; minifier level, rate limits, policies and budget hot-reload.
One command — pip install mcp-spine