That is what makes it composable: point it at a database or filesystem server and the agent's experience is unchanged except that the dangerous calls now stop for a decision. Deny-by-default is the setting to plan around — nothing runs until a policy matches it, so the first job after wiring it in is writing the policies for the operations you expect.
A governance proxy that sits between an agent and an upstream MCP server. It intercepts tool calls, evaluates each one against your policies, and forwards only the allowed ones; tool listing, resources and prompts pass through unchanged.
- Policy evaluation on every tools/call before it reaches the upstream server, with allow, approval required, or deny as the outcomes
- Per-tool mappings with glob patterns, so db_* or *_query can carry their own operation name, target integration, resource scope and data classification
- skip_governance on named tools, letting read-only calls like schema introspection through without an evaluation round trip
- Two approval behaviours: return an error immediately so the agent can tell the user and retry, or block until a reviewer decides, up to a configurable timeout
- Data classifications of public, internal, confidential and restricted, with a default for anything unmapped
- Outcomes recorded back for the audit trail, whether the call succeeded or failed
- An HTTP mode alongside stdio, exposing an authenticated MCP endpoint and an unauthenticated health check for remote clients
An account with the service and an API key. The published server definition takes SIDCLAW_API_KEY and SIDCLAW_AGENT_ID, plus SIDCLAW_UPSTREAM_CMD and SIDCLAW_UPSTREAM_ARGS naming the server it wraps; SIDCLAW_APPROVAL_MODE selects whether an approval returns immediately or waits. Installed from npm as @sidclaw/sdk and run over stdio. Without a matching policy, actions are denied by default.
One command plus a key — npm install @sidclaw/sdk, then supply credentials