Enforces commit-time policy checks for AI agent writes with ALLOW, DENY, or STEP_UP decisions and a tamper-evident audit log.
Ayrıca bilinen adı AvenueDAdmin/pywrit, writ-mcp
- Yıldızlar
- 2
- Araçlar
- 15
- İndirmeler, 30 gün
- —
- En son sürüm
- 0.1.2
- Son commit
- 13 Kas 2026
- Lisans
- MIT
Writ MCP nedir?
Writ bir MCP sunucusudur. Enforces commit-time policy checks for AI agent writes with ALLOW, DENY, or STEP_UP decisions and a tamper-evident audit log. 15 araç sunar; örneğin writ_check, writ_verify_token, writ_grant.
Özet, projenin README dosyasından oluşturuldu
Writ MCP sunucusu hakkında
Writ provides point-of-action control for AI agents by enforcing policy checks before any consequential write operation occurs. This MCP server uses a stdio transport to return ALLOW, DENY, or STEP_UP decisions, ensuring that agents operate within defined boundaries. It is designed for developers using MCP-compatible clients like Claude Desktop or Claude Code, requiring a WRIT_API_KEY for full functionality.
The system implements a check-before-write loop where the agent calls writ_check to receive a 90-second authToken. This token is then validated via writ_verify_token immediately before the action is executed. For higher security, the STEP_UP decision requires a human sponsor to approve the request through writ_grant. Every decision generates a tamper-evident audit receipt accessible via writ_receipts, providing a clear history of agent actions and authorizations.
Neler yapabilirsiniz
- 1Verify agent write permissionsAsk the agent to check if it has permission to perform a specific write action before it proceeds.
- 2Secure sensitive operations with tokensUse a time-bound token to ensure an authorized write operation is still valid at the moment of execution.
- 3Require human intervention for risky tasksTrigger a manual approval process when an agent attempts an action that requires a step-up decision.
- 4Audit agent decision historyRetrieve a detailed trail of all previous authorization decisions and outcomes.
Projenin README dosyasından alınmıştır. Her kullanım durumu, oradaki bir alıntı ile kontrol edilir.
Writ MCP nasıl yüklenir
Biçimler 10 Kas 2026 tarihinde doğrulandıWrit MCP'yi Claude Code içine yükleyin
$ claude mcp add --env WRIT_API_KEY=<YOUR_WRIT_API_KEY> --env WRIT_SPONSOR_TOKEN=<YOUR_WRIT_SPONSOR_TOKEN> writ -- uvx writ-mcpWrit MCP'yi Cursor içine yükleyin
~/.cursor/mcp.json
{
"mcpServers": {
"writ": {
"command": "uvx",
"args": [
"writ-mcp"
],
"env": {
"WRIT_API_KEY": "<YOUR_WRIT_API_KEY>",
"WRIT_SPONSOR_TOKEN": "<YOUR_WRIT_SPONSOR_TOKEN>"
}
}
}
}Writ MCP'yi VS Code içine yükleyin
.vscode/mcp.json
{
"servers": {
"writ": {
"type": "stdio",
"command": "uvx",
"args": [
"writ-mcp"
],
"env": {
"WRIT_API_KEY": "<YOUR_WRIT_API_KEY>",
"WRIT_SPONSOR_TOKEN": "<YOUR_WRIT_SPONSOR_TOKEN>"
}
}
}
}Writ MCP'yi Claude Desktop içine yükleyin
claude_desktop_config.json
{
"mcpServers": {
"writ": {
"command": "uvx",
"args": [
"writ-mcp"
],
"env": {
"WRIT_API_KEY": "<YOUR_WRIT_API_KEY>",
"WRIT_SPONSOR_TOKEN": "<YOUR_WRIT_SPONSOR_TOKEN>"
}
}
}
}Writ MCP'yi Codex içine yükleyin
~/.codex/config.toml
[mcp_servers.writ] command = "uvx" args = ["writ-mcp"] [mcp_servers.writ.env] WRIT_API_KEY = "<YOUR_WRIT_API_KEY>" WRIT_SPONSOR_TOKEN = "<YOUR_WRIT_SPONSOR_TOKEN>"
Writ MCP'yi Gemini CLI içine yükleyin
~/.gemini/settings.json
{
"mcpServers": {
"writ": {
"command": "uvx",
"args": [
"writ-mcp"
],
"env": {
"WRIT_API_KEY": "<YOUR_WRIT_API_KEY>",
"WRIT_SPONSOR_TOKEN": "<YOUR_WRIT_SPONSOR_TOKEN>"
}
}
}
}Writ MCP araçları 15
README dosyasından algılandıwrit_checkwrit_verify_tokenwrit_grantwrit_receiptswrit_policywrit_sandboxwrit_github_installationswrit_github_set_thresholdwrit_github_toggle_pr_commentswrit_manifestswrit_explain_receiptwrit_tenant_notify
| writ_check | — | |
| writ_verify_token | — | |
| writ_grant | — | |
| writ_receipts | — | |
| writ_policy | — | |
| writ_sandbox | — | |
| writ_github_installations | — | |
| writ_github_set_threshold | — | |
| writ_github_toggle_pr_comments | — | |
| writ_manifests | — | |
| writ_explain_receipt | — | |
| writ_tenant_notify | — |
15 aracın tümünü gösterDaha az araç göster
writ_principalswrit_verbswrit_keys
| writ_principals | — | |
| writ_verbs | — | |
| writ_keys | — |
Yapılandırma
WRIT_API_KEYGerekliGizliWrit API key (get one free at https://withwrit.com)
WRIT_SPONSOR_TOKENGizliWrit sponsor token, only required for sponsor tools (grant, revoke, reinstate)
WRIT_BASE_URLOptional custom Writ API base URL (default: https://api.withwrit.com)
| Ad | Açıklama | Sunucu |
|---|---|---|
| WRIT_API_KEY | Writ API key (get one free at https://withwrit.com) | GerekliGizli |
| WRIT_SPONSOR_TOKEN | Writ sponsor token, only required for sponsor tools (grant, revoke, reinstate) | Gizli |
| WRIT_BASE_URL | Optional custom Writ API base URL (default: https://api.withwrit.com) |
Otomatik kontroller
Çalıştırıldı 12 Kas 2026Tam rapor →Otomatik kontrollerimizden geçti. Bu bir güvenlik denetimi değildir: kodu okuyun ve sunucuya ihtiyaç duyduğu en dar erişimi verin. Kontroller nasıl çalışır
- Kaynak deposu bağlantılı ve erişilebilirGeçti
- Açık kaynak lisansı (OSI)Geçti
- Son bir yıl içinde commit veya sürüm mevcutGeçti
- Paket adı popüler bir pakete yakın değilGeçti
- Uzak uç nokta HTTPS kullanıyorKontrol edilmedi
- Yıkıcı araçlar etiketlenmişGeçti
- Modele yönelik gizli talimat yokGeçti
- Pakette ve bağımlılıklarında kritik uyarı yokGeçti
writ-mcp
The Writ gate as an MCP server. Give any MCP-compatible
agent point-of-action control: the agent calls Writ before a consequential
write, gets back ALLOW, DENY, or STEP_UP, and every outcome creates an
audit receipt.
Install
pip install writ-mcp
Requires Python 3.9+. Installs the writ-mcp command (stdio transport).
Configure
export WRIT_API_KEY="writ_..." # required; get one free: POST /v1/keys with an email
export WRIT_SPONSOR_TOKEN="..." # only for sponsor tools (grant, revoke, reinstate)
# export WRIT_BASE_URL="..." # default: https://api.withwrit.com
Add to your agent
Claude Code:
claude mcp add writ --env WRIT_API_KEY="$WRIT_API_KEY" -- writ-mcp
Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"writ": {
"command": "writ-mcp",
"env": { "WRIT_API_KEY": "writ_..." }
}
}
}
Any MCP client (generic stdio config):
{
"command": "writ-mcp",
"env": {
"WRIT_API_KEY": "writ_...",
"WRIT_SPONSOR_TOKEN": "writ_sp_..."
}
}
Hermes (NousResearch/hermes-agent) catalog entry — once published, this
package is installable from the optional-mcps catalog:
hermes mcp install writ
The check-before-write loop
The tool descriptions teach the agent this flow, but the short version:
writ_check(sponsor_id, agent_id, verb, target, purpose)— before the write.ALLOW→ you get a 90-secondauthTokenbound to that exact write.writ_verify_token(auth_token, verb, target, purpose)— immediately before executing, to prove the authorization still matches what you're doing.DENY→ do not proceed.STEP_UP→ a human sponsor approves (viawrit_grantor the dashboard), then check again.
Tools
| Tool | Who | What |
|---|---|---|
writ_check |
agent | Decision + 90s purpose-bound token |
writ_verify_token |
agent | Point-of-action token verification |
writ_grant |
sponsor | Approve a STEP_UP (one-time grant) |
writ_revoke / writ_reinstate |
sponsor | Kill switch on/off for a principal |
writ_receipts |
agent | Audit trail of decisions |
writ_policy |
agent | Tenant verb policy |
writ_sandbox |
anyone | Free 90-second demo grant, no key needed |
writ_github_installations |
admin | List connected GitHub App installations |
writ_github_set_threshold |
admin | Set the check-run fail threshold per install |
writ_github_toggle_pr_comments |
admin | Enable/disable the PR-comment bot |
writ_manifests |
agent | List repos with risk profiles or fetch one manifest |
writ_explain_receipt |
agent | Explain a receipt in plain language |
writ_tenant_notify |
admin | Get or update step-up notification settings |
writ_principals |
admin | List the tenant's principals |
writ_verbs |
admin | List the tenant's verb vocabulary |
writ_keys |
admin | List API key metadata |
Try it with no key: writ_sandbox → writ_check with verb="demo_write".
Source
Public repo: withwrit/pywrit (mcp/
directory). License: MIT.
Directory listings: Glama ·
MCP Registry io.github.withwrit/writ.
Writ MCP soruları
Writ MCP'yi Claude Code'a nasıl eklerim?
Terminalinizde claude mcp add --env WRIT_API_KEY=<YOUR_WRIT_API_KEY> --env WRIT_SPONSOR_TOKEN=<YOUR_WRIT_SPONSOR_TOKEN> writ -- uvx writ-mcp komutunu çalıştırın. Her projede kullanılabilir olması için --scope user ekleyin.
Writ MCP'yi Cursor'a nasıl eklerim?
~/.cursor/mcp.json dosyasını açın ve yukarıdaki yükleme bölümünde gösterilen Cursor yapılandırmasını kullanarak sunucuyu mcpServers altına ekleyin.
Writ MCP hangi araçları sunar?
15 araç sunar; bunlar arasında writ_check, writ_verify_token, writ_grant, writ_receipts, writ_policy yer alır.
How does the check-before-write loop work?
The agent calls writ_check to receive an ALLOW, DENY, or STEP_UP decision; an ALLOW provides a 90-second authToken which is then verified via writ_verify_token before execution.
Can I try Writ without an API key?
Yes, you can use the writ_sandbox tool for a free 90-second demo grant without needing a key.
What happens if a STEP_UP decision is returned?
A human sponsor must approve the action via writ_grant or the dashboard before the agent can proceed.