Extensible Mcp

Why this repo exists. An AI agent can be talked into anything by the text it reads — a poisoned web page, a crafted email, a malicious tool description. extensible-mcp assumes exactly that. It loads MCP servers dynamically so your context doesn't carry tools you aren't using, selects tools by retrieval instead of prompt-stuffing, and runs every proposed action through a filter pipeline enforcing Rego policy — plain, deterministic code the model never reads and can never be talked past. The agent proposes; it never commits.

The full architecture — signed human approvals bound to exact actions, provable policies, why "human in the loop" fails at agent speed — is in the white paper: Proof, Not Trust: Zero Trust for an Agentic World — readable in full on the page.

Connecting an LLM client to a set of MCP servers is normally a startup-time decision: list servers in a config, launch the client, hope you guessed right. There's no clean way to add a server mid-conversation, or to have the LLM itself reach for a capability that wasn't pre-configured.

And there's no standard control plane. If you want to block dangerous operations, enforce argument-shape policies, or gate which servers an LLM is allowed to connect to in the first place, you have to build that into each client or each server individually.