The MCP policy enforcement plane.
One deterministic allow/deny path on every Model Context Protocol call — where Cilium sits on the packet path and OPA Gatekeeper sits on the admission path.
Hangar enforces explicit policy on the MCP call path, not beside it. Every tool call crosses one decision path: caller identity, tool-access authorization, schema digest verification, egress rules. Nothing is inferred — there are no anomaly scores and no learned baselines, so a decision is reproducible from the policy that produced it. Self-hosted and MIT across the stack.
- Caller identity from JWT/OIDC, with RFC 8707 audience binding and multi-issuer trust.
- Tool-schema digest pinning: a server that changes a pinned tool's schema fails closed.
- L7 egress policy written in MCP semantics — which upstream, which tool, which arguments — through the
MCPEgressPolicyCRD (alpha API). - Governed task relay with a consent gate: Hangar interposes on the task lifecycle and never executes the task. Shipped in core 2.0.0; not in the 1.6.x line.
- Attributable audit chain, exported to SIEM as CEF, LEEF 2.0, RFC 5424 syslog or JSON-lines, and to OTLP.
- Kubernetes-native: CRDs, admission validation, and an operator that reconciles them.
- Not ML threat detection. Policy is deterministic and auditable.
- Not SaaS. No hosted control plane, and none planned.
- Not MDM or endpoint discovery. It governs MCP servers you register, not devices.
- Not a connector marketplace. It governs servers; it does not distribute them.
- Not full OWASP MCP Top 10 coverage. Command injection, intent-flow subversion and context injection are out of scope by design: prompt and argument semantics are not parsed. Coverage per category.
| Repository | What it is |
|---|---|
| mcp-hangar | The enforcement plane itself, and the Python package. |
| mcp-hangar-operator | Kubernetes operator: CRDs, admission validation, default-deny egress. |
| helm-charts | OCI-published charts for the core and the operator. |
| docs | Policy model, guides, ADRs, OWASP coverage. |
| benchmarks | Sequential vs parallel MCP tool-call measurements. |
pip install mcp-hangar
helm install mcp-hangar oci://ghcr.io/mcp-hangar/charts/mcp-hangar --namespace mcp-hangarWebsite · Docs · Learn · Why Is This Down? — our writing on observability and operations · MIT License
