Put a governance boundary between your agents and every API they can reach. Declared capabilities, risk-tiered execution, human approval, credential brokering and a complete audit trail. MIT.
View on GitHub ↗Homepage ↗Put a governance boundary between your agents and every API they can reach.
Declared capabilities only. Risk-tiered execution. Human approval for anything consequential. Credential brokering, so no agent ever holds a key. And a complete audit trail of every call, every decision, and every denial.
Quickstart · Adapter format · Risk model · Packages · Contributing
Want to see it working first? The demo template deploys the kernel over a mock backend in about a minute - no credentials, no database, no configuration:
Call a low-risk capability and it executes. Call a medium-risk write and it queues for a human instead of running. Call an agentforbidden delete and it is refused - and it never appeared in the agent's tool list to begin with.
Vendor-provided MCP servers are maximalist by design. They expose everything, so an agent receives a tool catalogue with dozens or hundreds of entries. Tokens burn, latency climbs, and the attack surface for prompt injection or privilege escalation grows with every tool you did not need.
At the same time, agent identity is largely absent. Most platforms treat agents as anonymous callers: no role, no audit trail, no permission model. When something goes wrong you cannot answer "which agent did this, on whose authority, and was it allowed?"
TCPcore is the missing layer. Not an agent framework. Not another MCP server. A governance kernel between your agents and any API.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/TCPCore--core.html)
Testing and observability for multi-agent delegation, MCP tools, permissions, sandboxed actions, prompts, and workflow replay.
flankerhqd/cyvisguardSecurity control plane for AI agents — identity and delegation, capability policy, data-flow taint and a live audit trail, enforced over MCP. Guards a real Claude Code end to end.
agent-chaperone/agent-chaperoneScreens an AI agent's tool calls before they run and tool results before the agent reads them. An MCP proxy plus a hooks adapter for a client's built-in tools.
ForkPoint/agent-lighthouseLighthouse-style audits for AI-agent readiness, LLM crawlers, MCP clients, and the agentic web
Chaarangan/StepgateAgents can't skip steps: an MCP server that runs gated, API-only stepfiles on the client's own model.
sgateway/s-gwLocal credential control for AI coding agents.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.