MCP tool-call governance · stdio proxy · local-first

Gate every action.
Prove every one
that ran.

Obsigno sits in front of your agents' MCP tool calls — enforcing policy before anything executes, then signing every decision into a chain where later modification is detectable.

Runs as a zero-code-change proxy for stdio MCP servers.
audit.jsonl
6 signed · 3 traces · 2 denied
unverified
The gap

Agents now touch real systems.

Your agents read files, query production, send mail, move money — all through MCP tool calls. When something goes wrong, most teams can't prove what the agent actually did, and can't stop a dangerous call before it fires.

Today the agent's logs usually live where the agent can write. That isn't evidence — it's a suggestion.

How it works

The path every tool call takes.

One choke point sits between the agent and its tools. Enforcement is only unbypassable when the client cannot reach or launch the upstream server directly.

01 / GATE

Check before it runs

YAML/JSON rules, Cedar, or OPA are evaluated before forwarding. With a policy configured, unmatched calls deny by default. Denied calls never reach the upstream server.

02 / RECORD

Sign it into the chain

Every decision — allow and deny — is appended to a hash-chained, Ed25519-signed ledger. Payloads are hashed, not stored, so you prove what happened without leaking secrets.

03 / VERIFY

Anyone can check it

Integrity is verifiable with the public key alone. Auditors prove the record is intact — without any power to change it.

Cross-server traces

One trace, across every server.

Agents rarely stop at one tool. Obsigno signs the same trace ID across every MCP server a task touches, so related actions can be verified together. Today, task-level correlation requires the client or orchestrator to propagate that trace ID across calls. Without propagation, Obsigno generates a per-call ID.

FOLLOWING trace: T-2 · a0f5…9b2
fs-serverread_file → allow
db-serverquery_rows → allow
db-serverdelete_table → deny
mail-serversend_email → allow
Evidence for governance—not a compliance shortcut.

Signed tool-call evidence can support record-keeping and control programs, including EU AI Act, SOC 2, and ISO/IEC 42001 work. Obsigno does not make a system compliant by itself; applicability and retention requirements depend on the deployment.

EU AI Act · Art. 12SOC 2ISO 42001
Design partner program

Validate the workflow before inventing the pricing.

Available now
Run it
The working stdio proxy and evidence layer.
  • Policy gate + tamper-evident ledger
  • Public-key verifier and live dashboard
  • YAML, JSON, Cedar, and OPA policy
  • Propagated cross-server trace IDs
Run the quickstart
Design partners
3–5 teams
Teams already using MCP against real systems.
  • Direct implementation support
  • Influence the HTTP and deployment roadmap
  • Test policies against your actual tools
  • Optional launch attribution
Start a conversation
No procurement deck required
Queued next
HTTP
Streamable HTTP transport after partner validation.
  • URL-based MCP adoption
  • Session and SSE compatibility
  • Deployment and auth requirements
  • Defined from real partner constraints
Start with stdio
Technical milestone, not shipped today
Quickstart

Wrap any MCP server. Change nothing else.

Put Obsigno in front of your existing server command — the audit trail and policy gate come for free.

~/agents
# install from source
$ git clone https://github.com/amudhan22/obsigno.git
$ cd obsigno && pip install -e ".[web]"

# wrap any stdio MCP server — no code changes
$ obsigno-mcp --policy policies/demo.policy.yaml --server-id demo-mcp -- python your_server.py
→ proxying tool calls · signing to audit.jsonl

# verify integrity with the public key alone
$ obsigno-verify .obsigno/audit.jsonl .obsigno/public_key.pem
OK 6 records verified, chain + signatures intact

# or spin up the full demo + dashboard
$ docker compose up -d --build → http://localhost:8787

Put a recorder in
front of your agents.

Start on stdio in five minutes. Bring the audit your agents don't have yet.