Show HN: cMCP, deny an AI agent's tool call and get a signed receipt
Summary
cMCP (Confidential MCP Runtime) is an open-source gateway that enforces MCP tool-call policy inside a hardware Trusted Execution Environment (TEE). It intercepts each tool call, evaluates it against a Cedar policy bundle, and enforces the decision (allow, deny, or redact) while recording the call in a hardware-sealed audit chain, producing a signed TRACE Claim verifiable without trusting the operator. The article outlines hardware providers, configuration, enforcement modes, and how to try it (including a software-only mode) along with verification and standards considerations.