tools/call, with no change to the agent or the server. This documentation
is itself an MCP server your coding tool can search. And the gateway is listed where MCP servers
are discovered. A fourth way, an operator server that lets approvers answer from their own
assistant, is planned and is not in 0.6.
Enforcement: the gateway
ctrlrun gateway is a process between the agent and the tool server. Every tools/call
becomes an action named mcp.<alias>.<tool>, decided by the same ctrlrun.yaml the decorator
uses, bound to a human’s approval where the policy says so, reserved by effect key so the same
consequence runs once across retries and workers, relayed, and recorded. Everything else on the
wire is relayed untouched.
- No code changes: the agent and the server are untouched.
- Works in any language: the gateway fronts an HTTP endpoint.
- Approvals bound to the exact tool call, arguments included.
- Every call leaves a receipt, refused ones too.
- Measure first with observe mode, in the same policy file.
Learning: this site is an MCP server
Every page here is reachable through an MCP server hosted with the site, with one tool, a search across the documentation. Add it to Cursor, VS Code or any MCP client and the assistant answers from these pages rather than from memory. Use the docs from your editor has the configuration.Discovery: the registries
The gateway is what you run to put CTRLRun in front of an MCP server, and it is listed in the MCP registries as such once the listing is live. Until then this section carries no link rather than a placeholder; the registry entry is a launch-day item.PLANNED: an operator server for approvers
An operator MCP server,ctrlrun mcp-operator, is planned and is not shipped. It would
expose the operator’s commands as tools, so that a person can list pending approvals, inspect
an action, approve, deny and resolve from their own assistant, with the same hash binding,
single use and expiry the CLI enforces, and with every write attributed. It is a new entry
point, so it gets its row in the specification’s entry-point table before any code; write tools
will refuse without an authenticated human principal from the configured identity provider,
never a name the client asserts. Nothing on this site describes it in the present tense. The
roadmap is where its status lives.
What MCP does not change
The guarantees are the same three ways in. A refund refused by the gateway is refused for the same reason, recorded in the same receipt shape, and verified by the samectrlrun verify as
one refused by the decorator. An agent that calls a CTRLRun tool to check its own actions would
not be enforcement, because a tool the agent chooses to call is a tool it can choose not to; the
gateway is in the path whether the agent likes it or not.