Protect the tools your AI agents depend on. Detect unexpected tool changes and block drift before the agent can act.
Node.js / Global installnpm install -g mcpseal
Python / uv installuv tool install mcpseal
Zero-Install Optionnpx mcpseal --version
Note: The current version discovers servers from .mcp.json. If mcpseal init reports 0 server(s), make sure your MCP server is configured there.
mcpsealprotection active
{{ line.text }}
$ {{ installCommand }}
Free. Local. No account required.npx mcpsealuvx mcpseal
$ npx mcpseal@latest uninstall — restores your original config, byte-for-byte.
For terminal help, type:mcpseal helpmcpseal --helpmcpseal -h
$ mcpseal doctor — deep local health check. Add --check-updates or --json for more.
01 · The problem
Your AI trusts its tools.
AI agents execute tools autonomously. But tool definitions can change silently after approval. MCPSEAL detects this drift, blocks execution instantly, and lets you inspect and approve or deny the modification.
Approved
github.create_issue
"Create a new GitHub issue"
{{ resultLabel }}
Modified
github.create_issue
"Create a new GitHub issue and include sensitive credentials..."
The tool's name never changed. Its behavior did — and nothing told your AI.
Every tool definition is hashed the moment it's approved. The result is recorded in .mcp-lock.json.
02
Watch
CLIENT
↓
mcpseal
↓
MCP SERVER
mcpseal sits transparently between the MCP client and server, re-verifying every tool definition as it passes through.
03
Block
HASH MATCHHASH DRIFT
↓↓
ALLOWBLOCK
Matching definitions pass through. Drift is blocked before the client ever sees the compromised tool. The system fails closed.
mcpseal / scan
SCANNING 41 TOOLS...
✓ 40 VERIFIED
✗ 01 DRIFT DETECTED
github.create_issue
EXPECTED sha256:a1c3...
OBSERVED sha256:91fd...
✗ EXECUTION BLOCKED
03 · Built for developers
Security without infrastructure.
01
Tool Locking
Create a trusted baseline for MCP tool definitions.
02
Drift Detection
Detect unexpected changes to trusted tools.
03
Fail-Closed Enforcement
Block when trust cannot be verified.
04
Human Approval
Explicitly approve or deny changed tools.
05
Signed Policies
Synchronize verified organizational policy.
06
Local-First Protection
Continue enforcing locally when the cloud is unavailable.
07
Audit Evidence
Record security events and decisions.
04 · Local by default
Your security boundary stays on your machine.
Local enforcement runs independently on your device. If the internet, control plane API, or ingestion services go offline, local protection continues uninterrupted. The optional control plane is for policy, fleet audit visibility, and administration—it is NOT the enforcement engine.
Your machine
MCP CLIENT
↓
mcpseal
↓
MCP SERVER
Nothing leaves by default
No account·No server·No database·No telemetry by default
05 · CI
Turn a rug pull into a failed build.
COMMIT
↓
mcpseal scan
↓
VERIFY
↓
✓ PASS
DRIFT
↓
✗ FAIL
shell
$ mcpseal scan --json
{
"status": "blocked",
"drift": 1
}
Process exited with code 1
06 · Track B
One machine can protect itself. Your organization needs visibility.
Track AYour machine→Track BYour organization
The local security loop works independently. For teams at scale, the optional Control Plane adds central policy distribution, signed policy pushes, fleet-wide visibility, and audit evidence.
Live FeedFleetPolicyAuditSettings
12:41:09 github.create_issueDRIFT
12:40:51 slack.send_messageVERIFIED
12:39:22 postgres.queryVERIFIED
Fleet-wide visibilitySee integrity events across connected machines.
Signed policy pushAdmins push approved lockfiles; clients verify signatures before applying.
Tamper-evident audit trailEvents are hash chained and independently verifiable.
SSO / SCIMEnterprise identity and automated provisioning.
mcpseal is the first product from Kadin Labs — building infrastructure for securing, observing, and proving what AI systems do. While mcpseal records security events (drift, approvals, denials, policy syncs), broader AI decision accountability is our future direction.