An MCP tool. Connect your assistant to /mcp and every tool call goes through a broker — scoped per caller, under a credential they never hold, revocable, metered and audited.
View on GitHub ↗One safe door between everything AI in your company and the tools it reaches.
Things in your company now call tools on their own. A coding assistant like Claude Code or Cursor. An agent your team built. A workflow in n8n or LangChain. A script with an LLM in the middle. Anything that speaks MCP, and increasingly everything does.
To let one read your Jira or open a pull request, somebody installs a connector and pastes in an API token — on a laptop, in a container, in a CI secret.
That token now sits somewhere nobody tracks. Nobody knows it exists, nobody can take it back, and nothing records what it did.
Fifty people means fifty credentials you did not issue, cannot revoke and cannot audit. When somebody leaves, their token keeps working.
Carnet puts one endpoint in the middle. Every assistant, agent and automation points at it instead of at the tool. The credential lives in Carnet, not wherever the thing is running.
Now you can answer the questions you could not answer before: who can reach what, what did they actually do, and how do I turn this off for one person — without touching anybody's machine.
It does not run your agents. They stay where they are — a laptop, your cluster, a vendor's cloud. Carnet only handles the tool calls they make, which is why it works the same for a coding assistant you did not build and an agent you did.
Every call takes the same path, and every one of them is written down.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/carnet-mcp--carnet.html)
Stateless governance proxy for MCP (2026-07-28): policy, dry-run, human confirmation, audit, tracing
bybit-exchange/kaasTurn scattered notes, docs and transcripts into a queryable Markdown wiki — an LLM knowledge-base compiler with MCP access, no embeddings, self-hosted.
CTRLRun/ctrlrunThe execution safety layer for AI agents.
Vangardo/unity-mcp-efficientToken-efficient facade and Codex skill for MCP for Unity: 96% smaller measured tool-schema surface, compact results, batching, and recovery.
batrapulkit/squidbrakeBrakes for your AI agents: every tool call is checked against your rules, held for human approval when risky, and recorded in a tamper-evident audit trail. Works with Claude Code and any MCP app.
chris-asmussen/wardenOne MCP server that fronts many MCP servers + Skills behind a small tool set and routes to the best one, keeping an agent's context tiny. Migrate your Claude Code MCPs/skills behind it.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.