Integration

Add authorization to any MCP server

Put scoped, revocable authorization in front of any Model Context Protocol server — with zero changes to the server itself.

Why authorize MCP tools?

An MCP server exposes tools an agent can call. By default, any client with the connection can call any tool. That is fine in a demo and dangerous in production: a prompt-injected or buggy agent can read data, send messages, or spend money it never should. Liceat sits in front of the server as a proxy: every tools/call is checked against the caller's warrant (scope, spend cap, rate limit, expiry, revocation) and recorded, before it ever reaches the server.

Protect an MCP server in one line

liceat-mcp --gateway https://liceat.com --token CW1~… --label github -- \
  npx -y @modelcontextprotocol/server-github

Every tool call is now verified, caveat-checked, revocation-checked, and audited. Denials return a structured JSON-RPC error with reasons. An unreachable gateway fails closed (deny).

Issue the agent a scoped warrant

Give the agent a warrant that permits only the tools and limits you intend:

import { issue, attenuate } from 'liceat';

// Issue a scoped root warrant for an agent…
const { warrant, attenuationKey } = issue(issuerSecret, 'kid-1', {
  principal: 'org:acme', agent: 'agent:assistant',
  caveats: [
    { type: 'resource', patterns: ['mcp:github/*'] },
    { type: 'action', actions: ['read'] },
    { type: 'spend_limit', currency: 'USD', max: 5000 },
    { type: 'expires', at: Math.floor(Date.now()/1e3) + 3600 },
  ],
});
// …then hand a NARROWER one to a sub-agent — authority can only shrink:
const sub = attenuate(warrant, attenuationKey, [{ type: 'action', actions: [] }]);

What you get

• Least privilege — each agent gets a warrant scoped to exactly the tools, resources, and spend it needs.
• Provable afterward — every allow/deny is recorded in a tamper-evident log you can audit or hand to a compliance reviewer.
• Instant revocation — kill a compromised agent's authority immediately, and it cascades to every sub-agent it delegated to.
• No new keys to leak — the agent never holds your API keys, only a narrow, expiring warrant.

Frequently asked

What is Liceat?

Liceat is permission infrastructure for AI agents. You issue a warrant — a scoped, spend-capped, revocable token — that grants an agent narrow authority; the agent presents it at the point of action; Liceat enforces it (scope, spend, rate, holder-binding, revocation) and records every decision in a tamper-evident log. It is open source with a zero-dependency SDK for TypeScript and Python.

Is it free?

The SDK and self-hosted gateway are free and open source. The hosted gateway at liceat.com gives 10,000 free decisions with no card, then meters at fractions of a cent per decision — payable by card or USDC.

Do I have to modify the MCP server?

No. liceat-mcp wraps any MCP server as a transparent proxy — the server is unchanged. You can also embed the SDK directly if you prefer.