Proxy, Policy & Audit (baseline)

The v0.1 baseline, always on, no flag: a reverse proxy in front of one MCP server, one of three policy backends (YAML, OPA/Rego, Cedar) evaluated per identity+tool call, and a structured JSON audit log of every decision.

See Identity and Policy and Audit Log for the full model. Minimal config:

listen: "0.0.0.0:8080"
upstream: "http://your-mcp-server:9000"
policy_file: "policy.yaml"
audit:
  output: stdout