euno
Beta
euno
Beta
One YAML file enforces what every agent is allowed to do — before the tool call reaches your backend. Drop-in. No infrastructure. No code changes to your agent or your server.
An agent tries to read a .pem key, drop a database table, and DM an external recipient. The proxy fires before the upstream is ever contacted — every decision is signed and audited.
# euno.policy.yaml — AgentCapabilityManifest # Validate: npx @euno/mcp validate ./euno.policy.yaml agentId: filesystem-agent name: Filesystem Agent version: 0.1.0 requiredCapabilities: - resource: read_file actions: [call] conditions: - type: allowedExtensions extensions: [".csv", ".json", ".txt"] - type: maxCalls count: 50 windowSeconds: 60 - resource: query actions: [call] conditions: - type: allowedOperations operations: [SELECT] - resource: send_dm actions: [call] conditions: - type: recipientDomain domains: [company.com]
The current release ships the full CapabilityCondition matrix, in-process LangChain.js enforcement, a tamper-evident OCSF audit log, and reference policies for the most popular MCP servers.
maxCalls, allowedOperations, allowedExtensions, allowedTables, argumentSchema, ipRange, recipientDomain, redactFields, policy, custom — all enforced before the upstream is contacted.
Every tool call — allowed or denied — is recorded as a cryptographically signed OCSF API Activity event at ~/.euno/audit.jsonl. Verify, rotate, summarise with euno-mcp stats.
Wraps Claude Desktop, Cursor, Windsurf, and any stdio MCP client with a one-line config change. HTTP transport for LangChain.js and other in-process agents.
@euno/langchain places the same enforcement engine inside the LangChain tool wrapper — no proxy process, no transport hop. Same YAML policy.
Ship-ready YAML for filesystem, Postgres, GitHub, Slack, and fetch — including a lexical SSRF guard. Drop one in your repo and run euno-mcp validate.
Plug in OPA, Cedar, or a bespoke rules engine via --policy-backend. Add domain-specific guards via --custom-condition. Both are repeatable flags, both fail-fast on load.
Runs entirely on your machine. No sign-up, no API key, no telemetry. npx away.
The MCP proxy is transparent to both sides — it speaks the MCP protocol on both ends and evaluates policy in the middle. See the full architecture →
Define allowed tools and argument constraints in a single euno.policy.yaml.
Pass npx @euno/mcp proxy as the command in your MCP host config. No agent or server changes.
Every tools/call is evaluated against the policy before it reaches the upstream.
Stream a live audit feed and aggregate denials with euno-mcp stats.
No sign-up. No cloud account. Runs entirely on your machine.