scopeblind-mcp — Claude Code MCP server: what it does, how to install
Security proxy for stdio MCP servers. It logs tool calls in shadow mode and blocks unauthorized actions under local policies.
claude mcp add scopeblind-mcp -- npx -y scopeblind-mcpWhat scopeblind-mcp does
The gateway runs as a transparent stdio proxy placed between an MCP client and the target server. It inspects incoming tools/call JSON-RPC requests. Other messages like initialize and notifications pass through without inspection. In the default shadow mode, it only logs decisions to stderr with a [PROTECT_MCP] tag.
Fine-grained control requires a JSON policy file. You can block dangerous tools outright, enforce rate limits like 5/hour, and define tier requirements. Running protect-mcp init creates local Ed25519 signing keys. Once configured, the proxy saves signed receipts to .protect-mcp-receipts.jsonl and exposes them locally at http://127.0.0.1:9876/receipts.
By default, all traffic passes. The gateway enforces rules only when launched with the --enforce flag alongside a policy file. Standard CLI proxy sessions stay at unknown tier unless an integration sets admission state programmatically.
What it helps with
- log MCP tool invocations in background shadow mode
- block dangerous operations through policy rules
- enforce rate limits on expensive tool requests
- generate Ed25519 signed receipts for local auditing
Example prompts for the agent
- Run protect-mcp init to generate a config template and Ed25519 signing keys.
- Export an audit bundle by running npx protect-mcp bundle --output audit.json.
- Check gateway stats and recent signed receipts with protect-mcp status.
How to install scopeblind-mcp
Platform CLI
claude mcp add scopeblind-mcp -- npx -y scopeblind-mcpPlatform CLI
codex mcp add scopeblind-mcp -- npx -y scopeblind-mcpConfig file
{
"mcpServers": {
"scopeblind-mcp": {
"command": "npx",
"args": [
"-y",
"scopeblind-mcp"
]
}
}
}Config file
{
"servers": {
"scopeblind-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"scopeblind-mcp"
]
}
}
}Platform CLI
gemini mcp add scopeblind-mcp npx -y scopeblind-mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about scopeblind-mcp
How to install scopeblind-mcp in Claude Code?
Run claude mcp add scopeblind-mcp -- npx -y scopeblind-mcp in your terminal.
What does scopeblind-mcp do?
It acts as a local proxy in front of stdio MCP servers, intercepting tools/call requests to record audit logs. When paired with a policy file, it blocks dangerous tools and enforces rate limits.
How to enable decision signing and rule enforcement?
Generate Ed25519 keys with npx protect-mcp init, specify your rules in a JSON policy, and start the proxy with the --enforce flag.
