PermitMCP
Execution-control layer for MCP agents: deterministic policy, Jev decisions, human approval and one-use execution permits.
Overview
PermitMCP is a lightweight execution-control layer that stops MCP agents from running tools unchecked. Each action proposal passes a control chain: deterministic policy first, then an optional decision provider (Jev), then a one-use execution permit, then the executor. Policy DENY stops before Jev is called, REVIEW waits for explicit caller approval, and ALLOW receives a single-use permit.
Version 0.5.0 adds selected third-party stdio MCP tools through operator configuration: upstream tools only appear when the operator sets a trusted local config and a separate approval token, and the client cannot choose the executable. Upstream calls use deterministic policy and need no Jev key; the original decision tools use a local mock unless you supply your own JEV_API_KEY. A showcase demonstrates allow, review and deny with real sandbox file tools. The README notes it is not a general MCP proxy or OS sandbox and that the real Jev API was not revalidated for this release. Documentation is in English and Chinese.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | Should this proposed tool action be allowed, reviewed or denied? | allow · review · deny |
How it works
- Agent proposes an action.
- Deterministic policy decides deny, review or allow.
- Optionally consult Jev for allowed or review cases.
- Issue a one-use permit and execute, or wait for approval.
Strengths
- Deny happens before any model call.
- One-use permits prevent replay.
- Runs offline with a mock provider.
Caveats
- Not a general MCP proxy or sandbox.
- Real Jev API not revalidated for v0.5.0.
Getting started
python -m pip install "git+https://github.com/qinpei-dev/permit-mcp.git@v0.5.0", then run permit-mcp; try python -m examples.showcase.At a glance
- Type
- MCP server
- Status
- prototype
- Language
- Python
- Runtime
- MCP server
- Has code
- yes
- Has tests
- yes
Use cases and integrations
How curated lists describe it
Gates MCP agent tool execution with deterministic policy, Jev decisions, explicit human approval, and one-use execution permits.
hellogumbo/awesome-jev
Frequently asked questions
Is Jev required?
No; deterministic policy and a local mock work without a key.
What is an execution permit?
A single-use authorisation issued only for allowed or approved actions.
Can the client choose arbitrary upstream tools?
No, upstream executables are set only by the operator's trusted config.
Related projects
Gateway that checks agent tool calls with policy plus Jev evidence, then binds approval to a single-use permit for that exact action.
MCP serverbetaTypeScriptMCP server giving any agent Jev's classify, score, yes/no check and allow/confirm/block gating of risky tool calls.
MCP serverbetaJavaScriptAuditable Zig terminal agent pairing Codex for coding with Jev typed preflight and postflight checks under deterministic policy gates.
CLIproductionZigMCP proxy and hooks that screen agent tool calls before they run and their results before the agent reads them, using Jev judgments.
MCP serverbetaTypeScriptXano backend template where Jev judges each agent tool call as safe, needs review or dangerous, and uncertain calls wait for a human.
ProjectbetaXanoScriptOpenAI-compatible endpoint that answers an agent's command-approval call with APPROVE, DENY or ESCALATE from a Jev Choice, failing closed.
ProxybetaPython