> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ctrlrun.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CTRLRun and MCP

> CTRLRun works with MCP in three ways: the gateway enforces policy, approval binding, effect keys and receipts in front of any MCP server.

CTRLRun works with MCP in three ways. The gateway sits in front of any MCP server and applies
your policy to every `tools/call`, with no change to the agent or the server. This documentation
is itself an MCP server your coding tool can search. And the gateway is listed where MCP servers
are discovered. A fourth way, an operator server that lets approvers answer from their own
assistant, is planned and is not in 0.6.

## Enforcement: the gateway

`ctrlrun gateway` is a process between the agent and the tool server. Every `tools/call`
becomes an action named `mcp.<alias>.<tool>`, decided by the same `ctrlrun.yaml` the decorator
uses, bound to a human's approval where the policy says so, reserved by effect key so the same
consequence runs once across retries and workers, relayed, and recorded. Everything else on the
wire is relayed untouched.

```text theme={null}
before    agent  ──▶  MCP server
after     agent  ──▶  CTRLRun gateway  ──▶  MCP server
```

* No code changes: the agent and the server are untouched.
* Works in any language: the gateway fronts an HTTP endpoint.
* Approvals bound to the exact tool call, arguments included.
* Every call leaves a receipt, refused ones too.
* Measure first with observe mode, in the same policy file.

[The gateway in five minutes](/mcp/gateway-in-5-minutes) is the page for someone who already
runs an MCP server.

## Learning: this site is an MCP server

Every page here is reachable through an MCP server hosted with the site, with one tool, a
search across the documentation. Add it to Cursor, VS Code or any MCP client and the assistant
answers from these pages rather than from memory.
[Use the docs from your editor](/mcp/use-the-docs-from-your-editor) has the configuration.

## Discovery: the registries

The gateway is what you run to put CTRLRun in front of an MCP server, and it is listed in the
MCP registries as such once the listing is live. Until then this section carries no link rather
than a placeholder; the registry entry is a launch-day item.

## PLANNED: an operator server for approvers

An operator MCP server, `ctrlrun mcp-operator`, is planned and is **not shipped**. It would
expose the operator's commands as tools, so that a person can list pending approvals, inspect
an action, approve, deny and resolve from their own assistant, with the same hash binding,
single use and expiry the CLI enforces, and with every write attributed. It is a new entry
point, so it gets its row in the specification's entry-point table before any code; write tools
will refuse without an authenticated human principal from the configured identity provider,
never a name the client asserts. Nothing on this site describes it in the present tense. The
[roadmap](/ROADMAP) is where its status lives.

## What MCP does not change

The guarantees are the same three ways in. A refund refused by the gateway is refused for the
same reason, recorded in the same receipt shape, and verified by the same `ctrlrun verify` as
one refused by the decorator. An agent that calls a CTRLRun tool to check its own actions would
not be enforcement, because a tool the agent chooses to call is a tool it can choose not to; the
gateway is in the path whether the agent likes it or not.

## Next

* [The gateway in five minutes](/mcp/gateway-in-5-minutes).
* [Three ways in](/get-started/three-ways-in) · [Get started](/get-started/quickstart) · [Why](/why).


## Related topics

- [The gateway in five minutes](/mcp/gateway-in-5-minutes.md)
- [Use the docs from your editor](/mcp/use-the-docs-from-your-editor.md)
- [CTRLRun](/index.md)
- [CTRLRun and framework human-in-the-loop](/compare/framework-hitl.md)
- [OWASP Top 10 for Agentic Applications](/OWASP-AGENTIC-TOP10.md)