feat(runtime): MCP proxy — intercept tools/call, deny on enforce

[xre217]

Summary

Ships the high-priority MCP proxy from TODO.md / registry (id: mcp-proxy).

A stdio/HTTP shim sits in front of any downstream MCP server:

1. Intercepts JSON-RPC tools/call
2. Builds a canonical Prismor event from params.name + params.arguments
3. Runs evaluate_tool_call (full policy + IAM + telemetry path)
4. Deny → MCP result.isError (or JSON-RPC error with --jsonrpc-error) without forwarding
5. Allow / non-tools/call → pass-through to upstream

Zero per-framework code — any MCP-speaking agent (Claude Code, Cursor, custom) gets coverage by wiring Prismor as the MCP server command.

CLI

# stdio — wire as the MCP server in agent config
prismor mcp-proxy --stdio -- npx -y @modelcontextprotocol/server-filesystem /tmp

# HTTP reverse proxy
prismor mcp-proxy --upstream http://127.0.0.1:9000 --port 8080

Claude Code / Cursor example:

{
  "mcpServers": {
    "filesystem": {
      "command": "prismor",
      "args": ["mcp-proxy", "--stdio", "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
    }
  }
}

Also

• Registry: mcp-proxy roadmap → shipped; coverage matrix regenerated
• Docs: docs/cli-reference.md, AGENT_INTEGRATIONS.md, TODO.md
• Module: prismor/runtime/mcp_proxy.py

Test plan

• python3 -m pytest tests/test_mcp_proxy.py -v (16 passed)
• CLI parser accepts --stdio -- cmd… and --upstream
• Manual: point an MCP client at the proxy and confirm rm -rf / style tools/call is denied

---

Related: #175 (registry enums), #176 (dashboard subject filter). Happy to iterate on framing edge cases or SSE/streamable-http if you want those next.

[xre217]

Hey — quick note so this isn’t three unprompted PRs in a vacuum.

Shipped against items in TODO.md / the registry:

• fix(registry): accept http surface + client-side blocking #175 — registry enums so verify_registry accepts http + client-side (main was failing on vercel-ai)
• feat(dashboard): subject filter on findings and events #176 — dashboard subject filter (?subject= + User column/dropdown)
• feat(runtime): MCP proxy — intercept tools/call, deny on enforce #177 — mcp-proxy (stdio + HTTP; tools/call → evaluate_tool_call → isError deny)

Happy to:

• squash / split / rebase however you prefer
• fix review nits same-day once first-time CI is approved
• take Gemini CLI hooks (or whatever’s highest leverage next) if useful

No rush — just wanted to make it easy to say yes/no/redirect.