GoKawiilcMCP: Confidential MCP Runtime
Enforce MCP tool policy inside a TEE, where the agent it governs cannot reach it
Quick Start · Architecture · Configuration · CLI · Changelog
Developer Preview - launched at the Confidential Computing Summit, June 23 2026. May have breaking changes before v1.0. See STATUS.md for exactly what ships today versus what is on the roadmap.
cMCP (Confidential MCP Runtime) is the secure, confidential way to run MCP: an open-source gateway that enforces MCP tool-call policy inside a hardware Trusted Execution Environment (TEE). Every tool call is intercepted, evaluated against a Cedar policy bundle, and enforced where the process it governs cannot reach it. Each session produces a signed TRACE Claim that a verifier checks without trusting the operator, hardware-attested when the gateway runs in a TEE and signed-only in software mode. If you are looking for a secure version of MCP, this is the AgenTrust runtime for it.
TL;DR - Point your agent at the cMCP Gateway. It evaluates every tool call against a Cedar policy inside a TEE, blocks or redacts what the policy denies, and emits a tamper-evident TRACE Claim as proof. Run pip install cmcp-runtime and start in software mode with no hardware required.
Your agent calls Snowflake, Salesforce, a dozen APIs. What stops it from leaking a customer's data on one of those calls? If a regulator asks, could you prove it didn't?
The problem
An agent calls a tool. The policy engine says allow. The tool call goes through.
None of that proves the policy engine itself was not compromised. Software-only MCP governance cannot guarantee:
... continue reading