MCP God Ships: Fine-Grained Control Over MCP Tool Infrastructure Goes Open Source [2026]

MCP God, which scored 37 points on Hacker News, shipped as an open-source MCP control plane that gives teams fine-grained governance over their entire MCP infrastructure. Operating as a transparent proxy between MCP clients and servers, it intercepts every method call to enforce policies, monitor traffic, and manage server lifecycles — without any changes to existing MCP server code.

• Transparent proxy: no client or server code changes required
• Tool-level access control: disable dangerous tools without removing servers
• Per-client rate limiting: prevent runaway agents from flooding servers
• Real-time monitoring: latency, error rates, call frequency per tool
• Dynamic server management: start, stop, reload servers from MCP God

How It Works: Transparent Proxy Architecture

MCP God operates as a reverse proxy that sits between MCP clients and servers. When a client sends an MCP method call (e.g., tools/call with params {name: "write_file", arguments: {...}}), the request flow is:

1. Intercept: MCP God receives the raw JSON-RPC request
2. Identify: Extract client identity from x-mcp-client-id header or source IP
3. Resolve: Look up policy for the server the client is targeting
4. Check tool access: Verify the specific tool is in the allowed list for this client-server pair
5. Rate limit: Check that the client has not exceeded its per-minute call budget
6. Forward: If all checks pass, forward the request to the actual MCP server
7. Log: Record the full transaction in the audit log

The entire pipeline completes in under 15ms for most deployments, with policy configuration hot-reloaded every 60 seconds from a YAML file.

Why MCP God Matters

As organizations adopt more MCP servers — file systems, databases, cloud infrastructure, internal APIs — the attack surface grows linearly. Without governance, any client-connected agent has access to every tool on every server. A single prompt injection in Claude Desktop could trigger delete_file on the filesystem server or drop_table on the database server.

MCP God solves this by inserting a policy enforcement layer between clients and servers. The proxy inspects every call, checks it against the policy configuration, and either forwards, rate-limits, or rejects based on rules that security teams define.

Key Features

1. Tool-Level Access Control

Before MCP God, disabling a dangerous tool meant either removing the entire server (breaking legitimate use) or modifying the server's source code. MCP God lets you disable individual tools via YAML policy configuration:

tool_access:
  filesystem:
    allowed_tools: [read_file, list_directory]
    blocked_tools: [write_file, delete_file]

The client still sees the filesystem server as available, but any attempt to call write_file returns an access denied error — the server never receives the request.

2. Per-Client Rate Limiting

Different clients have different trust levels. Claude Desktop (interactive, human-supervised) might get 200 calls per minute, while a CI pipeline agent gets 30. MCP God enforces these limits transparently, queuing or rejecting calls that exceed the client's budget.

3. Full Audit Trail

Every MCP call is logged with client identity, server targeted, tool invoked, parameters (truncated), timestamp, and whether it was allowed or blocked. This provides a complete audit trail for security reviews and incident investigations.

Community Response

Security teams have been the primary adopters. Key themes from the launch discussion:

• "This should be default in every MCP deployment" — top comment on HN
• Policy hot-reload without server restart is the killer feature for compliance teams
• Kubernetes sidecar deployment pattern emerging for containerized MCP deployments
• 78% of surveyed organizations said they would block MCP adoption without a governance layer — MCP God fills this gap

Enterprise Adoption Patterns

Three deployment patterns have emerged from early enterprise adopters:

Pattern 1: Centralized Gateway (most common) A single MCP God instance acts as the gateway for all MCP traffic in the organization. All clients connect to the gateway, which routes to internal MCP servers. Best for teams with 5-20 MCP servers and centralized security teams.

Pattern 2: Sidecar per Server (Kubernetes-native) Each MCP server pod includes an MCP God sidecar container. The sidecar handles governance for that specific server only. Best for teams with 20+ servers and existing Kubernetes infrastructure.

Pattern 3: Hybrid (large enterprises) A centralized gateway handles external client traffic (Claude Desktop, Cursor) while sidecars handle internal server-to-server calls. The gateway and sidecars share a Redis-backed policy store for consistent policy enforcement.

Open Source Ecosystem Response

The MCP God repository has attracted contributions for:

• Prometheus metrics exporter (pull request merged within 24 hours)
• Grafana dashboard template for monitoring MCP traffic patterns
• Terraform module for one-command cloud deployment
• Slack/webhook alert integration for policy violations

For a complete implementation guide, see the MCP God server walkthrough. from the launch discussion:

• "This should be default in every MCP deployment" — top comment on HN
• Policy hot-reload without server restart is the killer feature for compliance teams
• Kubernetes sidecar deployment pattern emerging for containerized MCP deployments

For a complete implementation guide, see the MCP God server walkthrough. The MCP Server Directory lists additional governance and security tools.

Production Reality Check

Single Point of Failure

MCP God processes every MCP call. If it goes down, all connected clients lose MCP access. Production deployments should run two instances with Redis-backed shared state for failover.

Proxy Latency Overhead

The proxy adds 2-15ms per call depending on policy complexity. For latency-sensitive operations, MCP God supports bypass mode for specific tool-call patterns. The smart model routing MCP server shows similar latency optimization patterns.

Key Takeaways

1. MCP God provides governance for the growing MCP attack surface — tool-level access control prevents prompt injection from triggering dangerous operations.
2. Zero code changes required — MCP God operates as a transparent proxy that intercepts at the transport layer without modifying existing servers.
3. Per-client rate limiting and full audit trails give security teams the visibility and control they need for enterprise MCP adoption.

Policy Configuration Examples

Here are three common policy configurations:

Development Environment (permissive):

rate_limits:
  default: {max_calls_per_min: 200, max_concurrent: 20}
tool_access:
  filesystem: {allowed: [read, write, delete]}  # Full access for dev
  database: {allowed: [select, insert, update]}  # Allow mutations in dev

Staging Environment (moderate):

rate_limits:
  claude-desktop: {max_calls_per_min: 100}
  ci-pipeline: {max_calls_per_min: 30}
tool_access:
  filesystem: {allowed: [read, write], blocked: [delete]}
  database: {allowed: [select], blocked: [insert, update, delete]}

Production Environment (strict):

rate_limits:
  default: {max_calls_per_min: 30}
tool_access:
  database: {allowed: [select], blocked: [all others]}
  filesystem: {allowed: [read], blocked: [write, delete]}

These configurations can be hot-reloaded without restarting MCP God or any connected server.

Metrics and Monitoring

MCP God exports Prometheus metrics at /metrics endpoint:

• mcpgod_requests_total{client, server, tool, allowed} — total call counts
• mcpgod_request_duration_ms{client, server} — latency histograms
• mcpgod_rate_limit_hits_total{client, server} — calls blocked by rate limiting
• mcpgod_access_denied_total{client, server, tool} — calls blocked by tool access control
• mcpgod_active_connections — number of currently connected clients

For a complete implementation guide, see the MCP God server walkthrough.

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect. For more MCP infrastructure tools, explore the MCP Server Directory and workflows directory.

Last tested & verified: September 2026 with Python 3.12, FastMCP 4.0.