Summary

Two ways in: a gate the agent cannot bypass, or a check it can call itself.

The wrap is the enforcement — the server behind it never sees a denied call. The three `assay_*` tools are the cooperative half, letting an agent validate arguments or a sequence and get back a suggested fix rather than a failure. Generating a first policy from a real trace is the practical way to start, since writing an allowlist from scratch for an unfamiliar server usually means blocking something you needed.

What it is

A policy layer for MCP. `assay mcp wrap` puts the Assay engine in front of a server so every tool call is checked before it is forwarded, and a second set of tools lets an agent check its own call before making it.

What you get

`assay mcp wrap --policy policy.yaml -- your-mcp-server` gates a server without changing its code; blocked calls never reach it
A policy is YAML: `tools.allow` and `tools.deny` by name, plus JSON Schema constraints per tool — a path pattern, a minimum length, `additionalProperties: false`
Decisions come back readable: ALLOW with `policy_allow`, DENY with `path_constraint_violation` or `tool_denied`
`assay_check_args` validates arguments against the schema and returns violations with suggestions and a suggested fix
`assay_check_sequence` validates a proposed next tool against the history that came before it
`assay_policy_decide` does an exact-name check against a compatibility blocklist — argument-aware evaluation belongs to `assay_check_args`
`assay init --from-trace trace.jsonl` writes a starting policy from what your agent actually did
`--audit-log` records mandate lifecycle events and `--decision-log` records every ALLOW/DENY as NDJSON; `assay evidence export` and `assay evidence verify` package and check them, and `assay evidence lint --pack eu-ai-act-baseline` checks against a compliance pack

Requirements

The Assay CLI, from `cargo install assay-cli`, plus a policy file. Any stdio-based MCP server works behind it. `assay mcp config-path cursor` prints the detected Cursor config location and a ready-to-paste entry; Windsurf and Zed take the same wrapped command under `mcpServers` and `context_servers` respectively.

Setup effort

One command — cargo install assay-cli