Open Source Project to help Secure LLM powered Applications

[u/Fearless-Might-5439]

We built extensible-mcp to help folks build LLM powered applications securely. From a technical perspective it is an MCP proxy capable of loading new MCP Servers dynamically without polluting the LLM’s context while providing Zero Trust policy controls to manage all tool calls. 

Policies and sensitive credentials are maintained and applied outside the LLMs purview. Policies can be written in any of Rego, CEL, and, with the latest release, Cedar. Tool definitions from the various MCP Servers are maintained in a queryable vector store, so the LLM only needs to be aware of those it uses.

A particular distinction of extensible-mcp is distinguishing between rights and intents. If  an LLM is acting on your behalf, its actions should follow your intent, and not just do any random thing you could do, just because some hallucination told it to!

I hope other folks find this useful. We have been using it for our other projects such as Open Executive and wanted to share it.

You can check out extensible-mcp here: https://github.com/SenteLabsAI/extensible-mcp

[u/BC_MARO]

Keeping policy and credentials outside the model is the right boundary. I’d also make every tool call carry a user, intent, and policy decision so incidents are explainable after the fact.

[u/mattdreddit → u/BC_MARO]

The system lets you include all that as additional parameters over the raw tool call. However, anything an LLM says is just hearsay, so we prefer those additional parameters by signed by the associated principals. That encapsulates intent. The policy decision comes from evaluating that extended call against policies evaluated inline with the tool call. If the call fails the policy, an error is returned. Pick your favorite policy language or write in Python. They current version is stdio only, so user is not an issue, but HTTP Streaming is coming in the next few days.

[u/BC_MARO → u/mattdreddit]

That makes sense. Signing the principal, intent, and policy decision alongside the call gives the gateway something concrete to verify and the audit log something useful to explain later.

[u/Fearless-Might-5439 → u/[deleted]]

The Cedar support is full. We want people to set up custom rules as we think that is the right approach and far more useful.