delego — Claude Code MCP server: what it does, how to install
Action authorization engine for AI agents with human terminal approvals, intent hashing, and an Ed25519-signed audit ledger.
claude mcp add --env DELEGO_HOME=<DELEGO_HOME> --transport stdio delego -- uvx delegoWhat delego does
delego acts as an authorization intermediary between autonomous agents and credential brokers. Standard API credentials verify scopes rather than human intentions. When an injection redirects a prompt, a valid credential still executes unwanted calls. delego blocks this confused deputy scenario using deterministic Python 3.10+ policies without calling any LLM during authorization decisions.
The stdio MCP server exposes five tools: delego_propose_action, delego_resolve_action, delego_pending, delego_audit_tail, and delego_show_policy. Crucially, approval and denial tools are omitted from the agent interface. Humans must review and grant permissions manually in the terminal with delego approve.
Every human approval targets an exact action fingerprint and works only once. Audit entries form an Ed25519 hash chain. Note that a local signing key offers no defense against root host intrusion, and catching tail truncation requires verifying against an external head anchor.
What it helps with
- stop unauthorized agent steps caused by indirect prompt injection
- require human terminal approval before sensitive credentials execute
- generate a tamper-evident Ed25519 audit chain for agent activity
- prevent approval replays across altered action payloads
Example prompts for the agent
- Submit this transfer proposal through delego_propose_action and wait for my clearance.
- Check for any parked tasks by calling delego_pending.
- Execute the authorized operation with delego_resolve_action using the granted fingerprint.
How to install delego
Platform CLI
claude mcp add --env DELEGO_HOME=<DELEGO_HOME> --transport stdio delego -- uvx delegoReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from delego <command>
Platform CLI
codex mcp add delego --env DELEGO_HOME=<DELEGO_HOME> -- uvx delegoReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from delego <command>
Config file
{
"mcpServers": {
"delego": {
"command": "uvx",
"args": [
"delego"
],
"env": {
"DELEGO_HOME": "<DELEGO_HOME>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from delego <command>
Config file
{
"servers": {
"delego": {
"type": "stdio",
"command": "uvx",
"args": [
"delego"
],
"env": {
"DELEGO_HOME": "<DELEGO_HOME>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from delego <command>
Platform CLI
gemini mcp add -e DELEGO_HOME=<DELEGO_HOME> delego uvx delegoReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from delego <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about delego
How to install delego in Claude Code?
Run claude mcp add delego -- uvx delego. If you want project-scoped policies and ledger keys, provide the directory path: claude mcp add --env DELEGO_HOME=<DELEGO_HOME> --transport stdio delego -- uvx delego.
What does delego do?
It validates whether an agent action reflects genuine user intent before unlocking external credentials. Decisions rely on deterministic code and human CLI confirmations rather than model evaluations.
Why are approval commands excluded from the MCP interface?
Exposing approval endpoints to the model defeats the security model. If the agent could call approve tools, prompt injections could authorize their own malicious operations without human awareness.
