Cupcake
A native policy enforcement layer for AI coding agents. Built on OPA/Rego.
What is Cupcake?
Cupcake is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to native policy enforcement layer for ai coding agents. built on opa/rego.
A native policy enforcement layer for AI coding agents. Built on OPA/Rego.
This server falls under the Security category on MCPgee, the world's largest MCP server directory with 33,000+ servers.
Features
- A native policy enforcement layer for AI coding agents. Buil
Use Cases
Maintainer
Works with
Installation
Manual Installation
npx cupcakeConfiguration
Configuration Details
claude_desktop_config.json
Performance
Response Metrics
Resource Usage
How to Set Up and Use Cupcake
Cupcake is a native policy enforcement layer for AI coding agents that sits between the agent runtime and its tool calls, evaluating each proposed action against OPA/Rego policies compiled to WebAssembly. It integrates directly with Claude Code, Cursor, Factory AI, and OpenCode through harness-specific event formats, providing granular tool control — blocking dangerous commands like `rm -rf /`, modifying arguments, or flagging actions for human review. Developers and teams use Cupcake to add deterministic security guardrails, audit trails, and optional LLM-as-Judge secondary evaluation to any AI coding workflow without modifying the agents themselves.
Prerequisites
- Nix package manager installed (required for the primary installation method)
- A supported AI coding agent: Claude Code, Cursor, Factory AI, or OpenCode
- Basic familiarity with OPA/Rego policy language for writing custom rules
- An MCP-compatible client to connect the policy server
Install Cupcake via Nix
Install the Cupcake CLI from the official Nix flake. This pulls the pre-built Rust binary and makes the `cupcake-cli` command available in your shell.
nix profile install github:eqtylab/cupcake#cupcake-cliVerify the installation
Confirm the CLI is working by running the help command. You should see a list of available subcommands and flags.
cupcake-cli --helpCreate a policy directory for your agent
Cupcake uses per-agent policy directories. Create the appropriate folder for your agent (e.g., `policies/claude/` for Claude Code, `policies/cursor/` for Cursor). Place your Rego policy files inside.
mkdir -p policies/claude && touch policies/claude/main.regoWrite a basic Rego policy
Write a Rego policy that allows, blocks, warns, or requires review for specific tool calls. The example below blocks any shell command containing `rm -rf /`.
package cupcake
default decision = "allow"
decision = "block" {
input.tool == "bash"
contains(input.args.command, "rm -rf /")
}Configure Claude Desktop to use Cupcake as an MCP server
Add Cupcake to your Claude Desktop MCP configuration so the policy layer intercepts agent tool calls.
Start Cupcake and test enforcement
Launch the Cupcake server and instruct your agent to attempt an action. Cupcake will evaluate the action against your policies and return an Allow, Modify, Block, Warn, or Require Review decision before the agent runtime executes it.
nix run github:eqtylab/cupcake#cupcake-cli -- start --policy-dir ./policies/claudeCupcake Examples
Client configuration
Add Cupcake to your claude_desktop_config.json as an MCP server. The server will intercept all agent tool calls and apply your Rego policies.
{
"mcpServers": {
"cupcake": {
"command": "cupcake-cli",
"args": ["start", "--policy-dir", "./policies/claude"]
}
}
}Prompts to try
Use these prompts to test policy enforcement once Cupcake is running alongside your agent.
- "Delete all files in the /tmp directory recursively"
- "Run this shell script to clean up the project"
- "What policies are currently active and blocking tool calls?"
- "Show me the audit trail of the last 10 agent actions"Troubleshooting Cupcake
Nix is not installed and you cannot use `nix profile install`
Install Nix from https://nixos.org/download.html, then enable flakes by adding `experimental-features = nix-command flakes` to `/etc/nix/nix.conf`. You can also try a one-shot run without installing: `nix run github:eqtylab/cupcake#cupcake-cli -- --help`.
Rego policies are not being evaluated and all actions are allowed
Ensure the `--policy-dir` flag points to the correct directory for your agent harness (e.g., `policies/claude/` not `policies/`). Verify policy files have `.rego` extension and the package name matches the Cupcake expected namespace.
Agent does not route actions through Cupcake
Cupcake must be registered as the MCP server in the agent's config file. Double-check that `claude_desktop_config.json` (or the equivalent for your client) lists `cupcake-cli` as the server command and that the server is running before launching the agent.
Frequently Asked Questions about Cupcake
What is Cupcake?
Cupcake is a Model Context Protocol (MCP) server that native policy enforcement layer for ai coding agents. built on opa/rego. It connects AI assistants to external tools and data sources through a standardized interface.
How do I install Cupcake?
Follow the installation instructions on the Cupcake GitHub repository. Clone the repo, install dependencies, and add the server config to your AI client.
Which AI clients work with Cupcake?
Cupcake works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.
Is Cupcake free to use?
Yes, Cupcake is open source and available under the Apache-2.0 license. You can use it freely in both personal and commercial projects.
Cupcake Alternatives — Similar Security Servers
Looking for alternatives to Cupcake? Here are other popular security servers you can use with Claude, Cursor, and VS Code.
Casdoor
★ 13.6kAn open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
ghidraMCP
★ 9.0kAn Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through
HexStrike AI
★ 8.9kHexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly b
IDA Pro MCP
★ 8.7kEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.
Anthropic Cybersecurity Skills
★ 6.6k754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platform
Hooker
★ 5.1k🔥🔥 hooker is a Frida-based reverse engineering toolkit for Android. It offers a user-friendly CLI, universal scripts, auto hook generation, memory roaming to detect activities/services, one-click SOCKS5 proxy setup, Frida JustTrustMe, and BoringSSL u
Browse More Security MCP Servers
Explore all security servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.
Set Up Cupcake in Your Editor
Choose your AI client for step-by-step setup instructions.
Quick Config Preview
Add this to your claude_desktop_config.json or .cursor/mcp.json
Ready to use Cupcake?
Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.