kcp-harness — Claude Code MCP server: audit what your agent reads
A proxy that decides which project knowledge an agent may reach and records every decision it makes.
claude mcp add kcp-harness -- npx -y kcp-harnessWhat kcp-harness — KCP compliance proxy does
kcp-harness takes the MCP calls your agent makes and routes knowledge access through itself. A classifier splits governed paths from ordinary ones, then the request walks a cascade of 14 deterministic gates covering audience, time, budget and context limits. No model takes part in planning, so the same input yields the same plan.
Governance leaves artifacts behind: per-request decision traces, an append-only JSONL log, a spend ledger with a ceiling, and approval tickets tied to a named reviewer. When verification fails, the agent gets nothing back. There is no way around the layer, since the agent only sees the proxy's MCP interface.
Install with npm install -g kcp-harness, run kcp-harness init to create harness.yaml, then kcp-harness integrate claude-code to write .mcp.json and PreToolUse hooks. The same integrate command covers Cursor, Copilot, Windsurf, Cline and other agents, each with its own config format. Pre-built binaries for Linux, macOS and Windows skip Node entirely.
What it helps with
- show why the agent opened a particular file
- keep agent spending under a set ceiling
- keep a log of every knowledge read
- block reads of deprecated or withdrawn documents
- send borderline reads to a human for sign-off
Example prompts for the agent
- Plan the knowledge load with
kcp_planand list the skipped units - Load a governed document with
kcp_load - Show the decision trace for the last read under
docs/
How to install kcp-harness — KCP compliance proxy
Platform CLI
claude mcp add kcp-harness -- npx -y kcp-harnessPlatform CLI
codex mcp add kcp-harness-kcp-compliance-proxy -- npx -y kcp-harnessConfig file
{
"mcpServers": {
"kcp-harness-kcp-compliance-proxy": {
"command": "npx",
"args": [
"-y",
"kcp-harness"
]
}
}
}Config file
{
"servers": {
"kcp-harness-kcp-compliance-proxy": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"kcp-harness"
]
}
}
}Platform CLI
gemini mcp add kcp-harness-kcp-compliance-proxy npx -y kcp-harnessStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about kcp-harness — KCP compliance proxy
How do I install kcp-harness in Claude Code?
Run claude mcp add kcp-harness -- npx -y kcp-harness, then kcp-harness init for harness.yaml and kcp-harness integrate claude-code for .mcp.json and the PreToolUse hooks.
What does kcp-harness do?
It intercepts agent calls that touch governed knowledge, runs them through a 14-gate cascade and logs the outcome. It also tracks spend and holds approval tickets.
What does kcp-harness need to run?
A harness.yaml file from kcp-harness init plus an integration for your agent. The planner uses no LLM, which keeps decisions reproducible.
