The gateway approach (OAuth + RBAC) solves the perimeter problem — who can connect. protect-mcp solves a different layer — what can they do once connected, and

The gateway approach (OAuth + RBAC) solves the perimeter problem — who can connect. protect-mcp solves a different layer — what can they do once connected, and how do you prove it. It wraps any MCP server as a stdio proxy. Per-tool policies (block, rate-limit, require human approval). Every decision gets an Ed25519-signed receipt that's verifiable offline — no callbacks, no accounts. The two layers stack: your gateway authenticates the caller, protect-mcp constrains which tools they can call and signs the evidence. npx protect-mcp -- node your-server.js MIT licensed. The receipts protocol has an IETF Internet-Draft: https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/ https://datatracker.ietf.org/doc/draft-farley-acta-signed-re... npm: https://npmjs.com/package/protect-mcp https://npmjs.com/package/protect-mcp