Trabecc is the gateway between your AI agent and the MCP servers it calls. Default-deny policy, full audit trail, per-tool rate limits — drop in front of Claude Desktop, Cursor, Claude Code, or your own agent in 60 seconds. No code changes.
npx trabecc@latest init && npx trabecc@latest run
⌘C
MCP gives your agent superpowers — and gives you no way to know which tools it called, on what arguments, or whether the call should have been allowed. Three months in, every team hits the same three walls.
You can't answer "what did my agent do today?" because the protocol doesn't log calls. When something breaks, you have no forensic record.
Every tool the MCP server exposes is callable. The read-only filesystem server can also write, and there's no built-in way to gate specific paths or operations.
Agents in production sometimes loop. Without per-tool rate limits, one bad prompt can ship your monthly Perplexity / OpenAI / S3 budget to a stranger.
Your agent thinks Trabecc is a single MCP server. Internally, Trabecc fans out to all your real upstream servers, namespaces their tools, and intercepts every call. Same wire format. Zero agent code changes.
No SDK to integrate. No agent code changes. No new infrastructure to run. Trabecc is one binary that speaks plain MCP on both sides.
Glob-matched allow/deny rules with optional argument-level predicates. Block fs__write_* when path matches /etc/* with one line of YAML.
SQLite-backed, ships with the binary. Records the calling client, redacts credential-shaped args. 90-day cloud retention available.
Token-bucket per qualified tool. Catch the runaway agent loop before it ships your API budget to a stranger.
Connect filesystem, GitHub, Slack, Postgres — all behind one MCP endpoint, with namespaced tools (github__search_issues).
Server-rendered HTML at localhost:4577. Recent calls, outcomes, top tools. Auto-refresh, no JS required.
YAML for servers, rules, and rate limits. One Node binary. Self-host on a laptop or run in your fleet — same code.
Policy lives where your team can read it: a single config file in git. No DSL, no remote control plane required, no learning curve. Argument-level rules give you fine-grained control without engineering investment.
Read the docs →# default-deny — opt in to tools, don't opt out
defaultPolicy: deny
servers:
- name: filesystem
command: npx
args: ["-y", "@modelcontextprotocol/server-filesystem", "~/code"]
rules:
- match: "filesystem__read_*"
effect: allow
# argument-level rule — never write under /etc
- match: "filesystem__write_*"
effect: deny
when: { path: "/etc/*" }
reason: "no writes under /etc"
rateLimits:
- match: "filesystem__*"
perMinute: 120
Server-rendered, no SPA, no auth headache. Open
localhost:4577 next to your agent and watch the audit
log fill in real time.
The bug isn't that the LLM made a bad tool call. The bug is that nothing in your stack was watching. Trabecc is what you wire in before that becomes your incident.
The OSS works fully without ever phoning home. Cloud retention, alerts, and team dashboards are the same code with one flag flipped.
Yes. Trabecc speaks plain MCP on both sides — it appears as a single MCP server to your client, and connects to your existing upstream servers as their client. No changes to either side. Tested against the official filesystem, github, slack, and postgres servers, plus any community server using the standard SDK.
Policy decisions are sub-millisecond. Audit writes are async. The fan-out adds one process hop, which adds about ~1-3ms per tool call. For agents that already wait hundreds of ms on LLM responses, this is unmeasurable.
No. Zero telemetry by default. The cloud-sync code is opt-in and only activates when you set cloud.apiKey in your config — that's the wedge between OSS and the paid tier.
Trabecc records every call's request, response size, duration, and outcome before passing the result back to the agent. The audit log is independent of what the agent claims it did. A useful pattern: have your reviewer compare the agent's narrative against the audit log.
Each agent gets its own Trabecc instance — they're cheap to spawn and don't share state. The cloud product centralizes audit logs across all of them so you have one dashboard. For 50 agents, you'd run 50 Trabecc processes (or sidecars if containerized) and one cloud account.
v0.1 is YAML-only — argument-level globs cover ~80% of real cases. v0.2 will add a webhook hook for arbitrary policy decisions. If you need this now, open an issue with your use case.
60 seconds to install. Default-deny by default. MIT licensed.