# occasio

A local MCP server that filters agent actions, exposes outbound traffic, and keeps a verifiable audit trail. It fits workflows that need explicit approval for sensitive access.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 9
- Author: occasiolabs
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/occasiolabs/occasio
- Updated: 2026-06-24
- HTML: https://affpapa.org/en/nevibecode/mcp/occasio

## What it does

occasio runs locally between an AI coding agent and its configured LLM endpoint. Tool calls pass through a policy file you control, while the server displays outbound data, blocks disallowed activity, and records a hash-linked log that can be checked offline later.

Its identity gate treats access to `ssh`, cloud controls, `sudo`, and `systemctl` as human-approved actions. The approval token cannot be issued by the agent itself. A `PreToolUse` hook installed with `occasio hook --install` covers execution that bypasses the proxy. Occasio keeps the audit data on the machine and uses no cloud service or telemetry.

Node.js ≥ 18 is required. In Claude Code, add the server with `claude mcp add occasio -- npx -y @occasiolabs/occasio`. The strict policy blocks secret reads and sensitive identity changes until a person approves them.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add occasio -- npx -y @occasiolabs/occasio
```

### Codex

**Platform CLI**
```bash
codex mcp add occasio -- npx -y @occasiolabs/occasio
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "occasio": {
            "command": "npx",
            "args": [
                "-y",
                "@occasiolabs/occasio"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "occasio": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@occasiolabs/occasio"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add occasio npx -y @occasiolabs/occasio
```

## When to use it
- inspect what an agent sends to its LLM
- block reads from `.env` and private keys
- gate `ssh` and `sudo` behind human approval
- verify an agent run from a local audit chain
- find the policy rule behind a blocked action

## Example prompts
- Show me the outbound data from this agent run and redact any secrets.
- Inspect the latest session and explain which policy rule blocked the command.
- Apply the strict posture and require approval before running `ssh`.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81163
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89899

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md