Track A — the CLI — runs entirely on your machine. There is no server, no database, and no signup required for local protection.
If integrity cannot be established — a missing lockfile entry, a hash mismatch, an unreadable definition — the tool is blocked. mcpseal never treats an unverifiable state as safe.
Each tool is fingerprinted with SHA-256 over its name, description, and inputSchema. The fingerprint is recorded in .mcp-lock.json and re-checked on every call.
The name, description, and inputSchema of every tool definition passing through the proxy, checked against its approved fingerprint at call time. mcpseal does not inspect the contents of individual tool-call arguments or results.
Nothing, by default. Track A makes zero network calls. The only network activity mcpseal ever initiates is explicit: mcpseal login, mcpseal policy-pull, or an opt-in mcpseal doctor --check-updates version check.
Joining a Track B workspace is an explicit action — mcpseal login, using device authorization. Nothing connects to a workspace automatically.
The Control Plane adds WorkOS-backed human login, Stripe billing, and SSO/SCIM for enterprise identity and automated provisioning, on top of everything Track A already verifies.
Admins sign an approved lockfile before it's pushed. mcpseal policy-pull fetches that policy and verifies its signature before applying it locally — an unsigned or invalid policy is rejected.
Track B audit events are hash-chained, so a tampered or deleted entry breaks the chain and is detectable independently of the Control Plane itself.
We take security vulnerabilities seriously. If you discover one, report it privately rather than disclosing exploit details publicly first.