MCP tool authorization

Passport's MCP proxy intercepts tools/call, requests authorization, and forwards only permitted calls to the upstream. It supports local stdio and remote Streamable HTTP/SSE transports. Discovery and non-tool protocol traffic are not a general-purpose authorization boundary.

Prepare a separate project

Complete the connection check, then create a project for real work. Leave its optional Vercel binding empty. Grant the agent the tool action with explicit server and tool limits, for example:

{
  "allowedServers": ["documents"],
  "allowedTools": ["read_document", "write_document"],
  "approveTools": ["write_document"],
  "dailyCalls": 100
}

Set a tool policy with source mcp. Use human approval for sensitive tools. The server name must match the proxy's --server value. Empty allowlists do not mean deny-all; list only what this agent needs.

Run from the repository

The proxy is source-distributed and is not a published npm package. With access to a Passport source checkout and Node.js 24+, install its locked dependencies:

npm ci
./node_modules/.bin/tsx packages/mcp-proxy/src/cli.ts --help

Configure PASSPORT_URL, PASSPORT_AGENT_ID, PASSPORT_ORGANIZATION_ID, PASSPORT_PROJECT_ID, and PASSPORT_AGENT_PRIVATE_KEY in the trusted process's environment or secret manager. Unlike the Node diagnostic, the CLI reads the private key from that environment variable, not a key-file variable.

From the repository root, start an already-installed stdio server:

./node_modules/.bin/tsx packages/mcp-proxy/src/cli.ts \
  --server documents -- node /absolute/path/to/your-mcp-server/index.js

Or point it at your remote server:

./node_modules/.bin/tsx packages/mcp-proxy/src/cli.ts \
  --server documents --transport http https://your-mcp-host.example/mcp

These paths and the remote URL are placeholders for your own server. Configure your MCP client to launch this wrapper, not the upstream directly. Pin and review the upstream version; do not silently download arbitrary executable code.

Runtime controls

--wait sets the approval wait in seconds (default 600). --transport accepts auto, http, or sse. Remote credentials can be supplied with PASSPORT_UPSTREAM_AUTHORIZATION; avoid putting secrets in shell arguments. PASSPORT_ON_BEHALF_OF records signed attribution, not independently verified human identity.

--redact sends empty arguments to Passport. That reduces recorded detail and means the receipt cannot attest to the omitted arguments. Without it, tool arguments are sent to Passport and may be recorded: do not place secrets there.

Enforce the boundary

The model must not have direct upstream credentials, access to the signing key, or an unguarded path to the same tool. Process, environment and filesystem isolation are the operator's responsibility. A subprocess running under the same user is not a strong isolation boundary.

Denied calls and approval failures must not be forwarded. Pending requests or rejected input may have no signed decision receipt. See the security boundaries before using the proxy for sensitive work.