extensible-mcp
An MCP proxy that sits between LLMs and MCP servers, providing dynamic tool retrieval and security policy enforcement through deterministic rules rather than LLM reasoning.
🔗 Visit extensible-mcp
Description
When you let an AI model call outside tools through MCP (the protocol that connects AI assistants to external services), you're trusting the model itself to behave — to only call the tools it should, with the access it should have. extensible-mcp puts a checkpoint in between: a proxy that decides what the model is allowed to do using fixed rules written in code, not by hoping the model reasons its way to the safe answer.
extensible-mcp is an open-source proxy that sits between LLMs and MCP servers, using RAG-based semantic search so agents can discover relevant tools without loading every tool definition into context (reducing token bloat), and enforcing access-control policies through a Rego policy engine rather than relying on the model's own judgment. It structurally guarantees a model can only call tools it has already surfaced via search, manages credentials without exposing them to the LLM, and is built in Python 3.11+ with pluggable filter pipelines for search, call, and server-load operations.
💬 Our review
The short version: the core idea here — enforce security with deterministic code instead of persuading the model to behave — is the right instinct as agentic systems get more tool access, and this is one of the first concrete implementations of it for MCP specifically.
Connecting an LLM directly to MCP servers with no proxy means access control lives entirely in the system prompt, which is fundamentally not a security boundary — a sufficiently adversarial input can talk a model into calling something it shouldn't. Commercial LLM gateways like Portkey add policy and routing controls at the API layer, but aren't purpose-built for MCP's tool-discovery model the way this project is. It's an early-stage open-source project from a small team, so production hardening and battle-testing against real adversarial prompts are still ahead of it — treat the security guarantees as promising but not yet independently audited. Worth adopting now if you're already exposing MCP tools to an LLM and want a real access-control layer instead of prompt-based hope; not necessary if your agent only ever calls a small, trusted, hardcoded set of tools.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Gratuit, licence Apache 2.0, aucune offre commerciale.
Pros
Contrôle d'accès déterministe via un moteur de politiques Rego
Découverte d'outils par recherche sémantique, réduit le bruit de contexte
Garantie structurelle : le modèle ne peut appeler que les outils déjà exposés
Gestion des identifiants sans les exposer au LLM
Gratuit et open source (Apache 2.0)
Cons
Projet jeune, pas encore audité indépendamment
Petite équipe, écosystème et documentation encore limités
Ajoute une couche d'infrastructure supplémentaire à opérer