mcp-zero-trust-layer

A security proxy that sits between an MCP client/agent and real MCP servers: hides tools from tools/list, blocks calls before they reach the upstream, validates arguments, requires human approval for risky actions (with a self-hosted review UI), redacts sensitive data in outputs and writes hash-chained audit logs. Declarative YAML config, mcpzt CLI, HTTP proxy and stdio wrapper modes, Prometheus metrics and Docker images on GHCR. PyPI package in developer preview.