Skip to content

Add Assay — MCP policy firewall with replayable evidence trail#190

Merged
wilsonccccc merged 2 commits intoTensorBlock:mainfrom
Rul1an:add-assay
Mar 18, 2026
Merged

Add Assay — MCP policy firewall with replayable evidence trail#190
wilsonccccc merged 2 commits intoTensorBlock:mainfrom
Rul1an:add-assay

Conversation

@Rul1an
Copy link
Contributor

@Rul1an Rul1an commented Mar 17, 2026

Assay is an open-source MCP policy enforcement proxy.

It sits between agents and MCP servers, giving every tool call an explicit ALLOW/DENY with a replayable evidence trail.

Key features:

  • Deterministic policy enforcement (YAML policies, argument constraints, sequence rules)
  • Replayable evidence bundles (export, verify, diff, lint)
  • Covers 7/10 OWASP MCP Top 10 risks (mapping)
  • Compliance packs (EU AI Act baseline, CICD starter, SOC2 baseline)
  • GitHub Action for CI gates
  • MIT licensed, no hosted backend required
cargo install assay-cli
assay mcp wrap --policy policy.yaml -- your-mcp-server

Added to the Security section.

Made with Cursor

Copilot AI review requested due to automatic review settings March 17, 2026 17:47
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s catalog README by adding a new entry under the Security category for an MCP tool-call firewall/policy enforcement proxy.

Changes:

  • Added a README list item linking to Rul1an/assay in the Security section.
  • Introduced an extra blank line and altered the usual ordering of “section description then bullets” in the Security section.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +1116 to 1120

- [Rul1an/assay](https://github.com/Rul1an/assay): The firewall for MCP tool calls. Deterministic policy enforcement proxy with replayable evidence bundles, OWASP MCP Top 10 coverage (7/10), and compliance packs. MIT licensed.
Servers interacting with security tools and platforms, vulnerability databases, security scanning, network security tools, or identity management.
- [ark-forge/mcp-eu-ai-act](https://github.com/ark-forge/mcp-eu-ai-act): Scans codebases for AI framework usage (16 frameworks) and checks compliance against EU AI Act requirements. Features 4-tier risk categorization, GDPR compliance checking, report generation, and compliance document templates.

Copy link
Contributor

@wilsonccccc wilsonccccc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — valid MCP server submission, well-described. Approving for merge.

@wilsonccccc wilsonccccc merged commit a951b75 into TensorBlock:main Mar 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants