Docs

MCP & proxy

Run mayrun as an MCP server, or put mcp-proxy in front of a high-risk upstream.

mayrun as MCP server

mayrun setup cursor
# or mayrun mcp

Tools include mayrun_run, mayrun_check, mayrun_status, plus policy suggest/tighten (proposal only).

Prefer agent instructions: Use mayrun_run / mayrun_check instead of unrestricted shell for side effects.

mayrun mcp-proxy --server-name filesystem -- \
  npx -y @modelcontextprotocol/server-filesystem "$PWD"

Intercepts stdio JSON-RPC tools/call, evaluates mcp matchers (pack mcp-safe), and appends receipts.

Command	Role
`mayrun mcp`	mayrun is the MCP server
`mayrun mcp-proxy -- <upstream…>`	mayrun sits in front of another MCP

Approval for require_approval: TTY or --approve-file (tool name per line). Fail closed.

MCP matchers apply to mcp-proxy tool calls only — they never match shell run / check.
Shell argv/capability matchers never match MCP calls.
Extend mcp-safe alongside shell packs — it does not weaken dangerous-defaults.