# mastyf.ai

A local gateway that checks MCP tool calls against security policies. Use it to control agent actions and keep an auditable execution record.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 21
- Author: mastyf-ai
- License: AGPL-3.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/mastyf-ai/mastyf.ai
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/mastyfai

## What it does

mastyf.ai sits between an AI agent and MCP tools. It evaluates proposed calls against policy and blocks actions that are not allowed. The listed threats include malicious tool arguments, attempts to reach secrets, shell attacks, and runaway token use.

On first launch, the gateway finds local MCP servers and tools, then asks you to describe intended permissions in plain English. You can stage a policy, inspect its difference from the active one, and activate it. The execution ledger can be checked with `mastyf audit verify`.

The Python gateway setup uses Git and installs the package from the repository. The MCP server can also run through `npx -y @mastyf_ai/server`; its Claude Code setup command requires `ALERT_WEBHOOK_URL`.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `MASTYF_AI_DB_PATH`, `ALERT_WEBHOOK_URL`, `METRICS_ENABLED` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env MASTYF_AI_DB_PATH=<MASTYF_AI_DB_PATH> --env ALERT_WEBHOOK_URL=<ALERT_WEBHOOK_URL> --env METRICS_ENABLED=<METRICS_ENABLED> --transport stdio mastyfai -- npx -y @mastyf_ai/server
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add mastyfai --env MASTYF_AI_DB_PATH=<MASTYF_AI_DB_PATH> --env ALERT_WEBHOOK_URL=<ALERT_WEBHOOK_URL> --env METRICS_ENABLED=<METRICS_ENABLED> -- npx -y @mastyf_ai/server
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mastyfai": {
            "command": "npx",
            "args": [
                "-y",
                "@mastyf_ai/server"
            ],
            "env": {
                "MASTYF_AI_DB_PATH": "<MASTYF_AI_DB_PATH>",
                "ALERT_WEBHOOK_URL": "<ALERT_WEBHOOK_URL>",
                "METRICS_ENABLED": "<METRICS_ENABLED>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mastyfai": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@mastyf_ai/server"
            ],
            "env": {
                "MASTYF_AI_DB_PATH": "<MASTYF_AI_DB_PATH>",
                "ALERT_WEBHOOK_URL": "<ALERT_WEBHOOK_URL>",
                "METRICS_ENABLED": "<METRICS_ENABLED>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e MASTYF_AI_DB_PATH=<MASTYF_AI_DB_PATH> -e ALERT_WEBHOOK_URL=<ALERT_WEBHOOK_URL> -e METRICS_ENABLED=<METRICS_ENABLED> mastyfai npx -y @mastyf_ai/server
```
Replace <…> with your own values

## When to use it
- intercept MCP tool calls before execution
- block access to secrets and dangerous shell commands
- define permitted actions in plain English
- verify the execution receipt ledger

## Example prompts
- Block attempts to delete files or make HTTP requests.
- Check MCP tool calls for attempts to read secrets.
- Show the staged policy and compare it with the active one.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74559
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89433

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md