Docs
Install
Install the proxy, point it at your MCP server config, and it applies cf.policy.yml to every tool call. Full CLI reference lands with the first early-access drop.
The policy file
Allow- and deny-lists in YAML. Rules match tool schemas on name, argument shape, and destination domain. A deny rule beats an allow rule, always.
What is checked
Destructive tool calls, filesystem escape, non-allowlisted domains, secret-shaped values, and prompt-injection payloads in tool output. The warning you got in the terminal is the same check the proxy runs.
The audit log
SQLite, local, append-only. Every allowed and denied call with the rule that decided it. Query it directly; there is no cloud copy to wait for.
Roadmap
Hosted control plane (fleet policies, audit sync, Slack alerting) is next but not built. Local-only is complete and stays the default.