Gatekeeper: Policy-as-code enforcement for MCP server access

[KryptosAI]

Vision

Right now, MCP Observatory produces receipts that say "blocked" or "passed." But nothing enforces that verdict. An agent can still connect to a server that scored 0/100 on security.

Close the loop: make MCP Observatory the policy enforcement layer that agents and platforms query before allowing MCP connections.

What "best in class" looks like

1. Policy-as-code format — A declarative policy file that says: "require security score >= 70, no HIGH findings, schema-quality >= 80."
2. Gatekeeper runtime — A lightweight proxy or SDK middleware that intercepts initialize requests and checks the server's latest receipt against policy.
3. Pre-flight mode — opencode, claude code, codex call mcp-observatory gate-check <server> and get pass/fail before the agent sees the tools.
4. Continuous enforcement — Agents re-check receipts on each session to catch servers that drifted since last approval.

Success Metric

Every major AI coding agent ships with an MCP Observatory gate-check integration, and no agent connects to an unscanned MCP server without explicit human override.

[KryptosAI]

Closing — strategy pivot. Focus is now on growing the Safety Index to 100+ servers. This will be revisited when the Index is full.