Managed read-only MCP gateway

Approved reads, enforced and recorded.

Your assistant connects to one managed MCP endpoint. It can discover and call only the reviewed read-only tools its credential allows. Every call is bounded to a fixed destination, and every call leaves a hash-linked record you can verify.

Request managed access Run the free assessor first

Every successful call returns its evidencetools/call → result

{
  "output": { …the reviewed projection only… },
  "execution_id": "exec_9f2c41b8d07a3e5c6b1d02f4",
  "release_digest": "sha256:7c01e3…",
  "audit_tip": "e81f4a…"
}

execution_idFinds every event written for this call.
release_digestNames the signed bundle that controlled it.
audit_tipHash of the last event. Compare it with the stored chain.

What you get

Six controls the model cannot talk its way around.

Identity from the access grant

An interactive OAuth session or automation credential resolves organization, principal, client, environment, and exact tool authority server-side. The model never supplies who it is.

request.received

Signed, immutable release

Your tools live in a content-digested, HMAC-signed bundle with its own static-assessment snapshot. It is verified before every request and cannot be edited in place.

release.resolved

Deterministic policy

Each environment binds one immutable, versioned read-only profile. The gateway checks that exact profile, release, organization, source, principal, credential, grant, and usage state before dispatch. No scoring, no heuristics.

policy.allowed

One fixed destination

Each tool names one reviewed public HTTPS endpoint. Redirects, private addresses, proxy inheritance, and caller-selected hosts are refused.

dispatch.started

Validated structured output

The upstream response must satisfy the reviewed output schema. Unreviewed metadata and free-form content are not relayed to the client.

output.validated

Linked audit chain

Each control point adds a hash-linked event without secrets or raw payloads. Search by exact execution facts, then verify the release composition, activation authority, source revision, and candidate evidence.

audit_tip

Console experience

Clear by default. Complete when you need the evidence.

Guided mode explains state, next actions, and call outcomes in plain language. Advanced mode exposes exact identifiers, revisions, filters, provenance, and immutable history. Both views use the same data, controls, and authority.

Guided

What needs attention?

Follow a state-aware setup journey, work from goal-based navigation, and read the outcome before the implementation detail.

Advanced

What exactly happened?

Inspect digests, revision history, release authority, audit filters, and the complete verified event chain.

Learn how to use both views

Source review

From reviewed MCP endpoints to one signed release.

An authorized organization operator controls each step. Each environment has its own release, stop state, client credentials, and upstream connections. Discovery never changes the active tool surface.

Discover and inspect

Connect to a public HTTPS MCP endpoint anonymously, with one write-only bearer bound to the exact environment and source, or through a pre-registered OAuth client whose metadata is discovered from the exact MCP resource. Redirects, private addresses, and oversized catalogs are refused.
Store its normalized catalog and complete deterministic assessment as an immutable source revision.
Run an immediate or scheduled bounded discovery check. A changed catalog enters an immutable field-level review queue; an unchanged check creates no duplicate evidence.
Accept or dismiss each observed change with a recorded reason. Only acceptance creates a reviewed revision. Observation alone never changes a candidate, signed release, or runtime.
Inspect every finding, behavior declaration, and input/output schema before selecting the release tools.

Test and activate

Curate one to 25 tools across one to five current source revisions. Every member must explicitly declare read-only and non-destructive behavior with closed object schemas. Keep its exact source and upstream identity while assigning a unique reviewed public name.
Run nine required input, authorization, output, destination, and evidence gates for every selected tool through the bounded gateway transport.
Retain safe case outcomes, digests, and dispatch facts for passed and failed attempts without retaining payloads. Every member must have an exact passing attempt for the complete candidate digest.
Publish the complete multi-source release atomically only after all selected tools pass, then activate or roll back in a separate confirmed action with append-only activation history.

Open source review

Production boundary

A narrow boundary, stated plainly.

The gateway publishes only what has been reviewed end to end. That is the point.

Included

Explicitly reviewed read-only tools, each with effect none.
One fixed public HTTPS endpoint, closed input/output schemas, timeout, and response limit per tool.
Organization-scoped named environments with separate signed releases, stop state, MCP credentials, optional upstream bearer, and audit evidence. Administrators are organization-wide; operators and viewers can be limited to an exact non-empty environment set.
Write-only upstream bearer rotation and removal. Stored ciphertext is bound to one organization, environment, and source; read APIs return metadata only.
Per-member upstream OAuth with authorization code and PKCE S256. Each encrypted grant belongs to one member, environment, and source; refresh is serialized across replicas, disconnect denies the next call, and automation credentials cannot borrow the grant.
Immutable source revision history, semantic diffs, signed release history, and recorded activation rollback.
One digest-bound policy profile per environment: the complete reviewed read-only boundary, public anonymous reads only, or authenticated public/internal/confidential reads. Operators can compare any retained release before binding; incompatible profile changes and activations are rejected atomically.
Stateless MCP 2026-07-28 over HTTPS for any compliant client.
Browser-authorized MCP sessions with PKCE, exact environment and tool consent, rotating refresh tokens, session inventory, current member-grant checks, and next-request revocation. Codex CLI 0.162.1 and Claude Code 2.1.299 are verified clients.
Credentials limited to an explicit subset of active release tools, plus independent organization, source, environment, tool, principal, and credential stops. A source stop removes only that source's members; an organization stop blocks managed discovery and execution while administration and evidence remain available.
Execution identifier, release digest, and audit-chain tip returned with every successful call.
Server-side audit search by environment, tool, principal, client, credential, release, outcome, decision, and time; verified detail binds the execution to the exact immutable activation and environment revision used at dispatch.
One-execution evidence packets with an owner-readable HTML summary, complete JSON chain, exact file digests, and an Ed25519-signed manifest that the open-source CLI verifies offline.

Not in scope

Write tools, approvals, or any consequential action.
Caller-chosen destinations, or passing your MCP credential through to upstream APIs.
Private upstream networks, provider-specific connectors, dynamic client registration, arbitrary headers, mTLS, arbitrary code, or OpenAPI and collection import.
Storing raw request or response payloads, or secret values, in the audit record.

How a read is controlled

Every control point writes an event. Every event links to the last.

#eventwhat is recorded

01request.received
Authenticated organization, principal, client, tool name, and a digest of the arguments.
02release.resolved
Release identifier, its SHA-256 digest, and the publisher. Signature verified first.
03input.validated
The schema the arguments were checked against and the arguments digest.
04policy.allowed
The deterministic decision reason and the exact scope that was required.
05credential.resolved
The credential reference used for the upstream call. Never the value.
06dispatch.started
Destination host, request fingerprint, and the timeout that applied.
07dispatch.completed
Destination, HTTP status class, response bytes, and duration.
08output.validated
The output schema, the output digest, and the fields that were redacted.
09response.delivered
Effect none, outcome not applicable, and the output digest handed to the client.

If any step fails, its rejection event is written instead and nothing is dispatched: release.rejected, input.rejected, policy.denied, credential.rejected, dispatch.failed, or output.rejected. If the audit record itself cannot be written, the read does not happen.

Read the chain top to bottom and you have the whole story of one call: who asked, which signed release applied, why policy said yes, where the request went, what came back, and what the model was shown. Search those retained facts without loading the entire ledger, then compare the returned audit_tip with the stored chain to confirm nothing was altered.

Tenant-owned state sits behind forced row-level security in PostgreSQL. Published releases and activation records reject update and delete. Rollback creates a new activation and keeps the exact authority history used by earlier executions.

Connecting a client

One endpoint. Interactive OAuth or an automation credential.

Add https://console.null.select/mcp to Codex CLI or Claude Code and start the client's OAuth login.
Sign in, verify the organization, environment, client, and exact reviewed tools, then approve the connection.
Short-lived access tokens refresh inside one bounded connected session. Access lists the session separately from automation credentials and can revoke it on the next request.
For unattended workloads, issue an expiring automation credential with an explicit tool subset and keep it in an environment variable.

Install and verify the Linux CLI

Interactive client setup

# Codex CLI 0.162.1
codex mcp add null-select --url https://console.null.select/mcp
codex mcp login null-select

# Claude Code 2.1.299
claude mcp add --transport http null-select https://console.null.select/mcp
claude mcp login null-select

Automation configuration

{
  "mcpServers": {
    "null-select": {
      "type": "http",
      "url": "https://console.null.select/mcp",
      "headers": { "Authorization": "Bearer <your credential>" }
    }
  }
}

Automation · list the granted tools

curl -sS https://console.null.select/mcp \
  -H "Authorization: Bearer $NULL_SELECT_CREDENTIAL" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/list' \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientInfo":{"name":"curl","version":"1.0.0"},"io.modelcontextprotocol/clientCapabilities":{"roots":{"listChanged":false}}}}}'

Enforced boundary

The spec sheet.

Full trust model

Protocol: MCP 2026-07-28, stateless Streamable HTTP with JSON responses, at POST /mcp, with constrained 2025-11-25 handshake compatibility for verified clients.
Authentication: OAuth authorization code with PKCE S256 for interactive clients, plus separate expiring automation credentials. Only token digests and safe session metadata are stored.
Identity: Organization, principal, client, environment, and scopes are derived from the connected session or automation credential. No caller-supplied tenant selector exists.
Connected sessions: Exact client, member, environment, and tool consent; 15-minute access tokens; rotating refresh tokens; family revocation on replay; inventory and next-request revocation across replicas.
Release: Immutable canonical bundle containing one to 25 reviewed tools from no more than five exact source revisions, with a SHA-256 digest, HMAC-SHA-256 signature, publisher, and static-assessment snapshot. Verified before every request.
Source lifecycle: Immediate or fixed-interval discovery checks create immutable evidence and field-level semantic diffs without calling tools. Explicit acceptance is required before a reviewed revision changes; candidate evidence, atomic inactive publication, activation, and rollback remain separate.
Upstream authority: Anonymous, write-only shared bearer, or per-member OAuth is declared in each immutable tool contract. OAuth grants use authorization code and PKCE S256 and bind one member, named environment, and source. AES-256-GCM token ciphertext stays server-side; serialized refresh and disconnect are effective across replicas. Automation never receives member authority.
Discovery: tools/list returns only the tools the connected session or automation credential allows.
Authorization: Deterministic. The resolved organization must match the release, the tool must be present, and the caller must hold the exact required scope.
Destination: One reviewed public HTTPS endpoint per tool. Redirects, literal IPs, private resolutions, and caller-selected hosts are rejected.
Network: DNS resolution checks, non-public addresses rejected, no redirects, no proxy inheritance, TLS 1.2 minimum.
Limits: Release-defined timeout, a maximum 256 KiB upstream result, and a 1 MiB MCP request body.
Output: Output-schema validation and normalized structured content. The built-in read also applies an explicit projection and field redaction. Public errors never reflect submitted values.
Audit: Hash-linked events per execution in PostgreSQL. No raw payloads and no secret values.
Tenancy: Forced row-level security on tenant-owned tables. Published releases and source revisions are immutable.
Failure mode: Fails closed. If release verification, policy, validation, audit persistence, or a dispatch control cannot complete, nothing is sent upstream.

Every row describes the deployed enforcement boundary. Verified against the live endpoint on 2026-10-14.

Managed access

How access starts.

Authorize the organization, review a source, prove the candidate, and connect a client.

step 1 / 4
Assess
Run your current MCP tool surface through the free assessor. The findings become the review input for your release.
free · no account
step 2 / 4
Authorize the organization
We bind your verified identity to one organization, an administrator, operator, or viewer role, and either every environment or an exact selected set.
identity-bound
step 3 / 4
Review the source
Discover a public MCP endpoint, choose anonymous, shared-bearer, or per-member OAuth authority, inspect its immutable assessment and schemas, and compare later revisions before selecting explicitly read-only tools.
operator-reviewed
step 4 / 4
Test, activate, connect
Prove the candidate through the gateway, publish and activate its signed release, then authorize an interactive session or issue an automation credential. Rollback remains an explicit recorded activation.
MCP 2026-07-28

Ready to put a real read behind the boundary?

Request an organization binding, then manage sources, connected sessions, automation credentials, and evidence in the console.

Request managed access