Content
# MCP Governor
> **Unified Governance Center for AI Tools** — Enable enterprises to securely, compliantly, and controllably access AI Agent capabilities
[](https://www.python.org/downloads/)
[](LICENSE)
## Why MCP Governor?
Your AI Agents are calling internal ERP, CRM, external maps, and other tools, but you may not have full control:
- 🔓 **Where are the permission boundaries?** — Can Agents access sensitive resources like executive compensation, core customer data, etc., without authorization?
- 🔓 **Are sensitive data leaked?** — Are customer phone numbers, ID numbers, and other sensitive information transmitted in plaintext during the call chain?
- 🔓 **Can we trace back and hold accountable after the fact?** — When a call is abnormal, can we accurately trace back the operation subject, call chain, and interception reason?
MCP Governor is designed to solve these three core risks: As a secure gateway between AI Agents and enterprise internal and external resources, **it is natively compatible with the MCP protocol, eliminating the need for existing Agent and business system modifications**. It uniformly manages REST/gRPC/MCP and other multi-protocol access, providing injection protection, automatic PII desensitization, and full-chain audit tracing capabilities, helping enterprises release AI productivity while maintaining data security and compliance.
**Enterprises seamlessly connect internal and external ecosystems, giving AI Agents real execution power; relying on enterprise-level security governance, achieving one-click trusted deployment.**
## Quick Start
```bash
git clone https://github.com/OntarioLT/mcp-governor.git
cd mcp-governor
cp .env.example .env && vim .env # Fill in LLM_API_KEY
docker compose up -d
curl http://localhost:7680/health # Expected output: {"status":"ok","version":"1.0.0"}
```
> For detailed deployment instructions, please refer to [DEPLOYMENT_GUIDE.md](DEPLOYMENT_GUIDE.md)
## Core Capabilities
### 🛡️ Security Governance
| Capability | Description |
|------|------|
| **Injection Protection** | 848 Aho-Corasick rules (7 categories), covering prompt injection, indirect injection, encoding bypass, and Chinese jailbreaking |
| **PII Desensitization** | Automatically identify and mask ID numbers, phone numbers, bank card numbers, and emails (Chinese regular expressions, < 3ms) |
| **Audit Tracing** | Structured audit logs + Agent identity + Langfuse LLM call tracking (Enterprise: Ed25519 signature chain) |
| **Zero-Trust Authentication** | JWT + API Key + OAuth 2.1/OIDC + OPA policy engine, controlling tool access by Agent/role |
| **Agent Isolation** | Double filtering by Agent name (allowed_tools) and role (OPA Rego policy), with the principle of minimum privilege |
### 🔌 Protocol Adaptation
| Capability | Description |
|------|------|
| **REST → MCP** | Dynamically proxy REST APIs to MCP tools with zero configuration (supporting OpenAPI automatic discovery) |
| **gRPC → MCP** | .proto reflection generates manifest + runtime gRPC proxy |
| **Streamable HTTP** | MCP 2025-03-26 standard transmission, backward compatible with SSE |
| **10+ Preconfigured Integrations** | High德/钉钉/微信/飞书/GitHub/Slack/Notion, etc. |
## Demo
### Quick Experience (Recommended)
```bash
cd mcp-governor
cp .env.example .env # No LLM_API_KEY needed
docker compose -f docker-compose.min.yml up -d
./demo/docker-demo.sh
```
Experience core features like injection detection, PII desensitization, and OPA policies with just Docker; a complete demo requires Python 3.11+ and PyJWT.
### Full-Scenario Demo (Enterprise Edition)
The enterprise edition image comes with a complete demo package (including LLM Agent automatic demonstration of 14 scenarios), which can be downloaded and experienced after startup. See [`demo/RUNBOOK_DEMO.md`](demo/RUNBOOK_DEMO.md) for details.
## Why Us?
| | MCP Governor | ContextForge (IBM) | AgentGateway |
|---|---|---|---|
| **Injection Protection** | ✅ Out-of-the-box 848 rules | ⚠️ Custom regular expressions/plugins required | ⚠️ Dependent on external Guardrails |
| **Chinese PII Desensitization** | ✅ ID numbers/phone numbers/bank card numbers | ⚠️ General PII, requires optimization | ❌ No built-in Chinese rules |
| **Local Ecosystem** | ✅ 钉钉/飞书/微信/高德 | ❌ No domestic SaaS | ❌ No domestic SaaS |
| **REST/gRPC → MCP** | ✅ Zero-configuration dynamic proxy | ⚠️ Manual configuration required | ⚠️ Supports OpenAPI |
| **Fine-Grained Authentication** | ✅ Agent name + OPA double isolation | ⚠️ Standard RBAC/SSO | ⚠️ CEL policy engine |
| **Audit and Tracing** | ✅ Agent identity + Langfuse LLM tracking | ⚠️ Basic logs + OTLP | ⚠️ Only OTLP |
**MCP Governor's Unique Positioning**: Out-of-the-box security governance + localized Chinese ecosystem. For enterprises and institutions, AI tool compliance can be achieved without secondary development.
## Editions
| Feature | Community Edition | Enterprise Edition |
|------|---------------------|----------------------|
| **Authentication** | ✅ JWT + API Key + OAuth 2.1 | ✅ + Admin UI SSO |
| **Injection Protection** | ✅ 848 Aho-Corasick rules | ✅ Same as Community Edition |
| **PII Desensitization** | ✅ ID numbers/phone numbers/emails/bank card numbers | ✅ Same as Community Edition |
| **Audit Tracing** | ✅ Structured logs + Agent identity | ✅ + Ed25519 signature chain |
| **OPA Policy** | ✅ Role permission control | ✅ Same as Community Edition |
| **REST → MCP** | ✅ Zero-configuration dynamic proxy | ✅ Same as Community Edition |
| **gRPC → MCP** | ✅ Automatic adaptation | ✅ Same as Community Edition |
| **Langfuse Tracking** | ✅ LLM call trajectory | ✅ Same as Community Edition |
| **External Platform Integration** | ✅ Direct connection to Gateway | ✅ Same as Community Edition |
| **Admin UI** | ✅ Basic management interface | ✅ + Policies + Monitoring |
| **Chain Detector** | ❌ | ✅ Chain risk detection |
| **License Verification** | ❌ | ✅ Enterprise edition license |
| **Full-Scenario Demo** | ❌ | ✅ Python example |
| **Enterprise Scenario Customization** | ❌ | ✅ Customization + SLA |
| **Source Code** | ❌ Closed-source distribution | ❌ Closed-source distribution (optional source code authorization) |
| **Image Source** | Docker Hub | Private Registry |
| **Pricing** | Free | Commercial authorization |
> 💡 Enterprise edition images require contacting business to obtain private Registry access permissions (see [About](#about)).
### Authentication Method
| Method | Header Format | Verification Method | Applicable Scenario |
|------|------------|---------|---------|
| **API Key** | `Authorization: ApiKey <key>` | Local lookup of agents.yaml | External platform docking (fixed key, never expires) |
| **JWT** | `Authorization: Bearer <token>` | Local signature verification (PyJWT + public key/private key) | Internal system, scenario with signature key |
| **OAuth 2.1** | `Authorization: Bearer <token>` | Introspection endpoint (RFC 7662) | Enterprise IdP integration |
> **OAuth 2.1 Description**: Currently, OAuth 2.1 only supports Opaque Token (verified by IdP's Introspection endpoint). If IdP issues a JWT Token, it will be processed by JWTHook using local signature verification (public key required).
## Client Integration
Any MCP-compatible platform (Claude Desktop, Dify, self-developed Agent) can directly connect to the Gateway:
```json
{
"mcpServers": {
"mcp-governor": {
"url": "http://<gateway-host>:7680/mcp",
"transport": "streamable-http",
"headers": {
"Authorization": "ApiKey <your-api-key>"
}
}
}
}
```
> **Docking Method**: MCP Governor is a secure gateway, and external platforms connect through API Key authentication. `config/agents.yaml` is the **Gateway-side identity configuration**, which is independent of the external platform's internal structure — you only need to create a Gateway identity for each external platform:
>
> ```yaml
> # config/agents.yaml — Gateway-side configuration, independent of DIFY/Claude and other platforms
> agents:
> dify_platform: # The name you give this connection (arbitrary)
> api_key: "dify-2026" # Tell the external platform to use this key to connect to the Gateway
> allowed_tools: # Which tools this platform can access
> - "erp.query_stock"
> - "crm.get_customer"
> - "maps_*"
> rate_limit: 10000/hour
> ```
>
> The external platform side only needs to configure the MCP Server URL + API Key, without understanding the Gateway's internal configuration.
## LICENSES
This repository (deployment configurations and documentation) is licensed under **Apache 2.0** — see the [LICENSE](LICENSE) file for details.
MCP Governor uses an **Open Core** licensing model. All runtime source code resides in a private repository and is expressly excluded from the Apache 2.0 license covering this public repository.
### 🆓 Community Edition
Free for internal and production use under the [MCP Governor Community License (EULA)](EULA).
| Component | Docker Image |
| :--- | :--- |
| Runtime | `ontariolt/mcp-governor` (tags: `community-*`) |
| Admin Interface | `ontariolt/mcp-governor-admin` (shared frontend) |
> **Note:** The runtime source code is not publicly distributed. The Admin UI is a shared component; advanced features require the Enterprise runtime.
### 🏢 Enterprise Edition
Governed by a separate commercial license agreement. Unlocks advanced features (e.g., Admin SSO, Ed25519 signing, Chain Detector) when connected to the Enterprise runtime.
| Component | Docker Image |
| :--- | :--- |
| Runtime | `ontariolt/mcp-governor` (tags: `enterprise-*`) |
Includes access to proprietary source code for internal deployment, customization, and integration, subject to a separate **Source Code License Agreement**.
**For Enterprise access, commercial licensing, or source code agreements:** [See About](#about)
## About
> **Lei Tian — AI Architect by profession, Traveler & Poet by passion.**
MCP Governor is a unified governance center for AI tools, including:
- **Free Features**: Authentication + policy + injection protection + PII desensitization + audit tracing + REST/gRPC/MCP multi-protocol access + Admin UI basic management
- **Commercial Enhanced Features** (require commercial authorization): Admin UI advanced enhancement and OIDC SSO · Enterprise full-scenario DEMO example · Ed25519 audit signature · Chain risk detection, etc.
- **Source Code Authorization** (requires separate agreement): Source code usage and secondary development, limited to customer internal deployment
- **Enterprise Customized Deployment + SLA Support**
📬 Enterprise services (including commercial authorization/customization/SLA):<br> Global: recursiontian@gmail.com (Response within 24-48h on weekdays)<br> Domestic contact: Follow my personal public account "微碰旅行" → Menu bar "More" → "Enterprise Services"
Copyright 2026 Lei Tian
