MCP Hangar — Claude Code MCP server: policy verdicts and audit
A self-hosted layer between your client and your MCP servers: every tool call gets a verdict, and changed tool descriptions are caught by digest pin.
claude mcp add --env MCP_CONFIG=<MCP_CONFIG> --transport stdio mcp-hangar -- uvx mcp-hangarWhat MCP Hangar does
MCP Hangar is a Python MCP server that sits on the call path and decides what reaches the model. Clients cache the tool list, so the call itself is the only place a provider can mediate in real time — that is where revocation, per-tenant scoping and audit attach.
Run mcp-hangar init and it locates your MCP client, writes a config, starts each server once and records a digest pin over every tool's name, description, inputSchema and outputSchema. If a server rewrites a description between runs, that tool is withheld from the model and calls to it answer as if the tool did not exist. mcp-hangar pin --check prints both digests and exits 1, which makes it a fit for CI or a pre-commit hook; --write adopts the change when you meant it. The upstream in examples/rugpull/ rewrites its own description on request, so you can watch this happen.
HTTP mode needs an auth block. Without one, Hangar refuses to bind a non-loopback interface — --unsafe-no-auth is for a quick demo only. Over stdio the spawning process is the trust boundary, so the caller is declared in auth.stdio.principal.
What it helps with
- block a tool call whose description was swapped between runs
- catch in CI that a server's tool set drifted from the pinned digest
- scope which tools and arguments a given tenant may reach
- keep an attributable log of who made which call
- serve MCP over HTTP with a REST API at
/api/instead of stdio
Example prompts for the agent
- Run
mcp-hangar init -yso it finds my MCP client and writes the config - Check
config.yamlwithmcp-hangar pin --check— I want to see if any tool description moved - Start
mcp-hangar serve --config config.yaml --http --port 8000and show me what/api/returns
How to install MCP Hangar
Platform CLI
claude mcp add --env MCP_CONFIG=<MCP_CONFIG> --transport stdio mcp-hangar -- uvx mcp-hangarReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-hangar <command>
Platform CLI
codex mcp add mcp-hangar --env MCP_CONFIG=<MCP_CONFIG> -- uvx mcp-hangarReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-hangar <command>
Config file
{
"mcpServers": {
"mcp-hangar": {
"command": "uvx",
"args": [
"mcp-hangar"
],
"env": {
"MCP_CONFIG": "<MCP_CONFIG>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-hangar <command>
Config file
{
"servers": {
"mcp-hangar": {
"type": "stdio",
"command": "uvx",
"args": [
"mcp-hangar"
],
"env": {
"MCP_CONFIG": "<MCP_CONFIG>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-hangar <command>
Platform CLI
gemini mcp add -e MCP_CONFIG=<MCP_CONFIG> mcp-hangar uvx mcp-hangarReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-hangar <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about MCP Hangar
How do I install MCP Hangar in Claude Code?
Add it with claude mcp add hangar -- uvx mcp-hangar. To point it at your own config, use claude mcp add --env MCP_CONFIG=<MCP_CONFIG> --transport stdio mcp-hangar -- uvx mcp-hangar.
What does MCP Hangar do?
It is a policy enforcement plane for MCP: it mediates tool calls, returns a verdict for each one, and keeps attributable audit records with SIEM export. Self-hosted, MIT licensed.
What does HTTP mode require?
A configured auth block. Hangar will not bind a non-loopback interface without it; keep --unsafe-no-auth for demos.
