MCP Governance Layer
Enterprise Governance Layer (Identity, RBAC, Credentials, Auditing, Logging, Tracing) for the Model Context Protocol SDK
What is MCP Governance Layer?
MCP Governance Layer is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to enterprise governance layer (identity, rbac, credentials, auditing, logging, tracing) for the model context protocol sdk
Enterprise Governance Layer (Identity, RBAC, Credentials, Auditing, Logging, Tracing) for the Model Context Protocol SDK
This server falls under the Security category on MCPgee, the world's largest MCP server directory with 33,000+ servers.
Features
- Enterprise Governance Layer (Identity, RBAC, Credentials, Au
Use Cases
Maintainer
Works with
Installation
Manual Installation
npx mcp-governance-sdkConfiguration
Configuration Details
claude_desktop_config.json
Performance
Response Metrics
Resource Usage
How to Set Up and Use MCP Governance Layer
The MCP Governance SDK (@ithena-one/mcp-governance) is a TypeScript library that adds an enterprise-grade governance layer on top of the standard @modelcontextprotocol/sdk Server class. It intercepts every incoming MCP request and runs it through a configurable pipeline that resolves caller identity, enforces role-based access control (RBAC), injects credentials securely, and writes structured audit log entries — all without requiring changes to your core MCP tool handlers. Teams building MCP servers for production or regulated environments use it to satisfy compliance requirements (who accessed what, when), prevent unauthorized tool invocations, and avoid scattering auth boilerplate across every server they build.
Prerequisites
- Node.js 18 or higher
- An existing MCP server built with @modelcontextprotocol/sdk
- npm, yarn, or pnpm for package management
- Backend implementations for governance interfaces (IdentityResolver, AuditLogStore, etc.) or the Ithena Managed Platform
- An MCP client such as Claude Desktop for end-to-end testing
Install the SDK and peer dependencies
Add @ithena-one/mcp-governance along with its required peer dependencies to your MCP server project.
npm install @ithena-one/mcp-governance @modelcontextprotocol/sdk zodReplace Server with GovernedServer
Import GovernedServer from the SDK and instantiate it in place of the standard Server class. GovernedServer wraps the base Server and adds the governance pipeline. Pass your governance configuration as the second argument.
import { GovernedServer } from '@ithena-one/mcp-governance';
import { Server } from '@modelcontextprotocol/sdk/server/index.js';
const server = new GovernedServer(
{ name: 'my-server', version: '1.0.0' },
{
identityResolver: myIdentityResolver,
roleStore: myRoleStore,
permissionStore: myPermissionStore,
credentialResolver: myCredentialResolver,
auditLogStore: myAuditLogStore,
}
);Implement governance interfaces
Create implementations of the interfaces you need. At minimum, implement IdentityResolver to extract caller identity from request context, and AuditLogStore to persist audit records. The SDK ships with in-memory default implementations suitable for development.
// Minimal development-mode setup using built-in defaults
import { InMemoryAuditLogStore, StaticRoleStore } from '@ithena-one/mcp-governance';
const auditLogStore = new InMemoryAuditLogStore();
const roleStore = new StaticRoleStore({ 'user-role': ['tool:read', 'tool:write'] });Register your MCP tools as before
Register tools, resources, and prompts on the GovernedServer exactly as you would on a standard Server. The governance pipeline runs automatically for every request before your handler executes.
server.setRequestHandler('tools/call', async (request, context) => {
// context.identity, context.credentials are populated by the pipeline
return { result: 'handled' };
});Connect a transport and start the server
Connect a StdioServerTransport (for Claude Desktop) or another transport. The GovernedServer handles everything from there.
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
const transport = new StdioServerTransport();
await server.connect(transport);MCP Governance Layer Examples
Client configuration
claude_desktop_config.json entry for an MCP server built with the governance SDK. Replace the command and args with your compiled server's actual entry point.
{
"mcpServers": {
"governed-server": {
"command": "node",
"args": ["/path/to/your/governed-server/dist/index.js"],
"env": {
"NODE_ENV": "production"
}
}
}
}Prompts to try
Governance SDK enhances the server infrastructure rather than adding user-facing tools, but these prompts validate the pipeline end-to-end.
- "List the available tools on this server."
- "Call the 'read_data' tool with parameter id=123."
- "What tools am I authorized to use?"
- "Run the 'admin_reset' tool." (should be denied if role lacks permission)
- "Show me the audit log for the last 10 requests."Troubleshooting MCP Governance Layer
Request rejected with 'Identity Required' even though credentials were passed
RBAC is enabled but no IdentityResolver is resolving the caller. Implement an IdentityResolver that reads the identity from the request transport context (e.g., HTTP headers, JWT), or disable RBAC for development by omitting roleStore and permissionStore from the config.
Peer dependency conflict or version mismatch error on install
Check the peerDependencies field in @ithena-one/mcp-governance's package.json and align your @modelcontextprotocol/sdk version accordingly. Run 'npm install @modelcontextprotocol/sdk@<required-version>' then reinstall the governance SDK.
Audit log entries not persisted after requests
The default InMemoryAuditLogStore only holds records in memory and is lost on restart — it is for development only. For production, implement the AuditLogStore interface to write to a database, SIEM, or log aggregator, and pass your implementation in the GovernedServer config.
Frequently Asked Questions about MCP Governance Layer
What is MCP Governance Layer?
MCP Governance Layer is a Model Context Protocol (MCP) server that enterprise governance layer (identity, rbac, credentials, auditing, logging, tracing) for the model context protocol sdk It connects AI assistants to external tools and data sources through a standardized interface.
How do I install MCP Governance Layer?
Follow the installation instructions on the MCP Governance Layer GitHub repository. Clone the repo, install dependencies, and add the server config to your AI client.
Which AI clients work with MCP Governance Layer?
MCP Governance Layer works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.
Is MCP Governance Layer free to use?
Yes, MCP Governance Layer is open source and available under the Apache-2.0 license. You can use it freely in both personal and commercial projects.
MCP Governance Layer Alternatives — Similar Security Servers
Looking for alternatives to MCP Governance Layer? Here are other popular security servers you can use with Claude, Cursor, and VS Code.
Casdoor
★ 13.6kAn open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
ghidraMCP
★ 9.0kAn Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through
HexStrike AI
★ 8.9kHexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly b
IDA Pro MCP
★ 8.7kEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.
Anthropic Cybersecurity Skills
★ 6.6k754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platform
Hooker
★ 5.1k🔥🔥 hooker is a Frida-based reverse engineering toolkit for Android. It offers a user-friendly CLI, universal scripts, auto hook generation, memory roaming to detect activities/services, one-click SOCKS5 proxy setup, Frida JustTrustMe, and BoringSSL u
Browse More Security MCP Servers
Explore all security servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.
Set Up MCP Governance Layer in Your Editor
Choose your AI client for step-by-step setup instructions.
Quick Config Preview
Add this to your claude_desktop_config.json or .cursor/mcp.json
Ready to use MCP Governance Layer?
Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.