Use case

Gate high-risk MCP upstreams

Put mcp-proxy in front of filesystem or shell MCPs and evaluate tools/call.

Teams wiring third-party MCP servers · pack mcp-safe

When the agent already speaks to a third-party MCP, wrap it:

mayrun mcp-proxy --server-name filesystem -- \
  npx -y @modelcontextprotocol/server-filesystem "$PWD"

mcp-safe denies sensitive writes, approves shell-like tools, and allows common reads. Receipts still append. See MCP docs.