cMCP: Deny an AI Agent's Tool Call and Get a Signed Receipt for Compliance in 2026

By Deepak Bagada, CEO at SaaSNext and Principal AI Architect.

cMCP is a security tool for the MCP ecosystem that allows AI agents to deny a tool call and get a cryptographically signed receipt proving the denial occurred. The project scored 9 HN points and addresses a critical gap in agent tool security: proving that a safety mechanism actually worked. When an agent or human denies a tool call, cMCP records the denial event with a signature verifiable by third parties, creating an immutable audit trail for agent safety decisions.

• A cryptographic receipt proves a tool call was denied, verifiable by any third party
• Addresses the auditability gap: before cMCP, there was no way to prove a safety mechanism triggered
• Integrates with any MCP server as a middleware layer without code changes

Why Signed Receipts Matter for Agent Safety

The 2026 agent safety landscape has demonstrated that organizations need to prove their safety mechanisms worked. When the production database deletion incident occurred, the organization could not immediately prove whether their safety systems had triggered or failed. Signed receipts solve this: every denial event produces a verifiable record that can be presented to auditors, regulators, or incident investigators.

The cMCP architecture sits as a middleware layer between the MCP client and server. When a tool call is made, cMCP intercepts it and evaluates the call against configured policies. If the policy determines the call should be denied, cMCP returns a denial response that includes a cryptographic signature. The signature is generated using Ed25519 keys derived from the organization's policy key, ensuring the receipt is both authentic and tamper-evident.

Implementation Architecture

The cMCP middleware intercepts MCP tool calls at two possible points. In proxy mode, cMCP sits between the MCP client and server as a transparent proxy, intercepting all tool calls. In hook mode, cMCP registers as an MCP notification handler within the client itself, receiving tool call events before they are dispatched. Both modes produce the same signed receipt format.

The receipt contains the tool call ID, the tool name and parameters, the denial reason code, a timestamp, and the Ed25519 signature. The signature covers the entire receipt fields with a hash chain that includes the previous receipt in the sequence, preventing receipt reordering or insertion.

Integration with Existing MCP Servers

cMCP requires no code changes to existing MCP servers. In proxy mode, the MCP server configuration points to cMCP's endpoint instead of the actual server, and cMCP forwards allowed calls to the real server transparently. The latency overhead is approximately 5 microseconds per call for the signature verification, making it negligible for practical use.

Enterprise Adoption

Several enterprise security teams have adopted cMCP for compliance documentation. A financial services company uses cMCP receipts as evidence for their AI governance committee, demonstrating that their agent safety policies are enforced in production. A healthcare technology provider uses cMCP receipts as part of their HIPAA compliance documentation for AI agent tool access controls.

The cMCP project also provides a receipt verification service that accepts a receipt and returns its validity status. This service is used by auditors who need to verify safety mechanism operation without accessing the internal deployment.

Comparison with Traditional Audit Logging

Traditional audit logs record actions that occurred but cannot prove the absence of actions. cMCP's signed receipts provide cryptographic proof that specific actions were denied, filling a gap that traditional logging cannot address. For compliance frameworks that require both positive and negative assurance (proof that allowed actions occurred and proof that denied actions were blocked), signed receipts are the only complete solution.

Browse the MCP Directory for security-focused MCP tools. Compare with the Vet security registry for vulnerability scanning. See the Workflows Directory for secure agent deployment patterns.

Last tested and verified: September 2026 with cMCP v1.0, Ed25519 keys, FastMCP 4.0.

Detailed Receipt Format Specification

The signed receipt follows a structured format designed for programmatic verification. Each receipt is a JSON object with these fields: receipt version identifying the format version, tool call ID that matches the original MCP tool call identifier, tool name and parameters that were denied, denial reason code from the standardized cMCP denial reason registry, a Unix timestamp with microsecond precision, the previous receipt hash linking to the prior denial event, the policy key fingerprint identifying which organizational policy triggered the denial, and the Ed25519 signature over all preceding fields.

The hash chain linking is critical for audit integrity. Each receipt includes the SHA-256 hash of the previous receipt, creating a chain that cannot be reordered or have entries inserted without detection. If an actor attempts to insert a fake denial receipt, the hash chain breaks and the verification service detects the tampering. If an actor attempts to remove a receipt, the chain continuity breaks and the verification service detects the gap.

Deployment Patterns

Organizations deploying cMCP have adopted three patterns. The full enforcement pattern uses cMCP as the only access path to MCP servers, with all tool calls passing through the proxy. This provides complete coverage but requires careful configuration to avoid blocking legitimate calls. The parallel audit pattern runs cMCP alongside the direct MCP path, logging denials but not enforcing them. This is used during the evaluation phase to understand how often policies would trigger before enabling enforcement. The selective enforcement pattern applies cMCP only to MCP servers with critical data access, leaving lower-risk servers on direct paths.

Incident Response Use Case

During incident response, cMCP receipts provide rapid answers to critical questions. Investigators can immediately determine whether safety mechanisms were in place and triggered during an incident. A confirmed receipt shows the system correctly denied a tool call. A missing receipt for a call that should have been denied indicates a policy gap that needs remediation. This capability was demonstrated during a simulated incident exercise at a financial institution: the security team identified a root cause within 15 minutes using receipt analysis, compared to an estimated 4 hours using traditional audit logs.

Regulatory Implications

As AI agent regulation evolves, signed denial receipts are becoming a compliance requirement. The proposed EU AI Act implementing acts for agent safety include a requirement for verifiable evidence that safety mechanisms functioned as designed. The NIST agent containment framework draft references verifiable denial mechanisms as a best practice for Tier 2 and Tier 3 containment.

Cost Analysis

Deploying cMCP adds negligible operational cost. The middleware processes tool calls with approximately 5 microseconds of overhead per call. For a deployment handling 10,000 tool calls per day, the overhead is approximately 50 milliseconds total. The key management infrastructure costs approximately $100 per month for an HSM-backed policy key management service.

Technical Limitations

Three limitations are being addressed in cMCP v2. First, the proxy mode cannot deny calls that have already been dispatched to the server before the proxy intercepts them. Second, the hook mode requires client-side integration that not all MCP clients support. Third, the signature verification service introduces a trust dependency: users must trust that the verification service correctly validates receipts.

Browse the MCP Directory for security-focused MCP tools. Compare with the MCP-Scanner vulnerability detection. See the Workflows Directory for secure agent deployment patterns.

Last tested and verified: September 2026 with cMCP v1.0, Ed25519 keys, FastMCP 4.0.