Gatekeeper

io.github.Runestone-LabsPublished by GitHub account Runestone-Labsv0.1.2Updated Oct 24, 2026

Run MCP tool calls through Runestone Gatekeeper — policy enforcement, human approval, audit.

VerifiedSTDIODesktop onlyCloud & Infrastructure Developer Tools Security & Monitoring

Server details

Identifier: io.github.Runestone-Labs/gatekeeper
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account Runestone-Labs for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.Runestone-Labs%2Fgatekeeper.svg)](https://sourceweft.com/mcp/io.github.Runestone-Labs%2Fgatekeeper?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

A local MCP front door that routes an assistant's shell, file-write and HTTP calls through Runestone Gatekeeper for policy checks, human approval and audit.

What you can do: Run shell commands through Gatekeeper's policy gate (shell_exec). Write files through the gate (files_write). Make egress-policed HTTP GET/POST requests (http_request). Call any other Gatekeeper tool by name through a generic escape hatch (gatekeeper_call). Check that the Gatekeeper server is reachable (gatekeeper_health). Each gated call returns allow with output, or an error for deny or pending approval.
When to use it: Use it when you want an assistant's shell, file and network actions to pass through a central policy engine with audit logging and possible human approval, rather than letting the model touch systems directly. It is only useful alongside a running Gatekeeper server.
Requirements: A running Gatekeeper server reachable at GATEKEEPER_URL (default The npm package @runestone-labs/gatekeeper-mcp run over stdio, typically via npx, so Node.js is needed. GATEKEEPER_ROLE is required; GATEKEEPER_AGENT_NAME and GATEKEEPER_RUN_ID are optional. Desktop MCP client only.

Before you install

The server can run shell commands, write files and make HTTP requests, so it is a real execution path; safety depends on Gatekeeper's policies and approvals. Actions may be held for human approval and will not run until approved. A paid team/cloud approval service is described as planned and not publicly available, with no payment collected. Only calls routed through Gatekeeper are covered, not the client's other tools.

Installation

In SourceWeft

Open Gatekeeper in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Runestone Gatekeeper — MCP Server

An MCP server that lets any MCP client (Claude Desktop, Claude Code, Cursor, …) run real tool calls — shell, file writes, HTTP, or any Gatekeeper tool — only through Runestone Gatekeeper. Every call is policy-checked, may require human approval, and is audited. The model never touches your systems directly; Gatekeeper sits in front.

MCP client (LLM)  ──tools/call──▶  gatekeeper-mcp  ──policy-gated──▶  Gatekeeper  ──▶  shell / files / HTTP

MCP client (LLM)  ──tools/call──▶  gatekeeper-mcp  ──policy-gated──▶  Gatekeeper  ──▶  shell / files / HTTP

Requirements

A running Gatekeeper server (see the repo root). This package is just the MCP front door; it does nothing on its own.

Install / configure

It runs over stdio. Add it to your MCP client config, e.g. Claude Desktop (claude_desktop_config.json):

json

{  "mcpServers": {    "gatekeeper": {      "command": "npx",      "args": ["-y", "@runestone-labs/gatekeeper-mcp"],      "env": {        "GATEKEEPER_URL": "http://127.0.0.1:3847",        "GATEKEEPER_ROLE": "openclaw"      }    }  }}

{  "mcpServers": {    "gatekeeper": {      "command": "npx",      "args": ["-y", "@runestone-labs/gatekeeper-mcp"],      "env": {        "GATEKEEPER_URL": "http://127.0.0.1:3847",        "GATEKEEPER_ROLE": "openclaw"      }    }  }}

Env	Required	Default	Meaning
`GATEKEEPER_ROLE`	yes	—	The policy role this server presents to Gatekeeper for every call.
`GATEKEEPER_URL`	no	`http://127.0.0.1:3847`	Gatekeeper base URL.
`GATEKEEPER_AGENT_NAME`	no	`mcp-client`	Name recorded in audit logs.

Shared approvals for unattended agents

Local Gatekeeper and this MCP integration are free. Need a teammate to handle approvals while your agents run unattended? We're testing Gatekeeper Team at $49/month, for up to five members and five instances. The proposed Cloud service would coordinate a held action, a teammate's approval or denial, and a record of the outcome. Cloud is planned, not publicly available, and no payment is collected during this test. Only actions actually routed through Gatekeeper are covered; installing the MCP server does not cover a client's other tools.

See the proposed workflow and share your team's needs. The form also lets you optionally report a first real routed action or return use on a later day. These are manual self-reports, not verified external activation. Don't send commands or raw audit logs; this test adds no automatic usage reporting to the MCP server.

Tools

Tool	Gatekeeper tool	Use
`shell_exec`	`shell.exec`	Run a shell command.
`files_write`	`files.write`	Write a file.
`http_request`	`http.request`	HTTP GET/POST (egress-policed).
`gatekeeper_call`	(any)	Generic escape hatch — call any Gatekeeper tool (e.g. `memory.query`) by name.
`gatekeeper_health`	—	Check the Gatekeeper server is reachable.

Every gated call returns one of:

allow → the tool output.
deny → an error result explaining why (the call did not run).
approve → an error result saying a human must approve it in Gatekeeper; the call did not run.

Security model

This server is a policy boundary, so it is deliberately strict:

Identity is pinned server-side. Role comes from GATEKEEPER_ROLE; origin is fixed to model_inferred and taint to mcp_client. The MCP client cannot set or override actor / role / origin / taint / capability tokens via tool arguments — there is no code path from a tool argument to any of those.
Fail closed. A deny, a pending approval, or any malformed/unexpected Gatekeeper response is surfaced as an error — never as a successful result.
No endpoint traversal. Generic tool names are validated as strict dotted identifiers; ../, slashes, and the like are rejected before any request.
No leakage. The Gatekeeper URL and anything resembling a credential are scrubbed from error messages before they reach the client.

These invariants are covered by an adversarial test suite (src/*.test.ts).

Distribution

Published to npm as @runestone-labs/gatekeeper-mcp and listed on the MCP Registry as io.github.runestone-labs/gatekeeper (see server.json). The MCP Registry is in preview.

License

Apache-2.0

Source: integrations/mcp-server/README.md at commit 130d0b0

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.1.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts