● Covered by 1 source · 1 reportMedium impact1 neutral
cMCP Runtime Launches for Secure AI Agent Tool Call Enforcement in TEEs
Key points
- cMCP Runtime enforces AI agent tool-call policies inside a hardware TEE.
- Every tool call is evaluated against a Cedar policy bundle.
- Denied actions are blocked or redacted, and a signed TRACE Claim is produced.
- Addresses risks like policy tampering and compromised evaluators in software-only systems.
Introduction of cMCP Runtime
cMCP (Confidential MCP Runtime) has been released in developer preview, offering a secure method for managing AI agent interactions with external tools. This open-source gateway runs within a hardware Trusted Execution Environment (TEE), intercepting and evaluating every tool call against a predefined Cedar policy bundle. The system ensures that policies are enforced where the governing process cannot be compromised.
Addressing Security Vulnerabilities
The cMCP Runtime aims to mitigate security risks inherent in software-only policy enforcement. Traditional methods are vulnerable to issues such as rogue administrators swapping policy bundles, supply chain vulnerabilities affecting the evaluator's decision-making, or audit logs being tampered with. By operating within a TEE, cMCP ensures the integrity of the policy, the evaluation process, and the audit trail.
How cMCP Works
When an AI agent attempts a tool call, cMCP intercepts it. The call is then evaluated against a Cedar policy inside the TEE. If the policy denies the action, it is blocked or redacted. Each session generates a signed TRACE Claim, which a verifier can check without needing to trust the operator. This claim is hardware-attested when running in a TEE or signed in software mode. The policy bundle's hash is measured into the hardware attestation report before any code execution, further securing the process.
Key Benefits and Implementation
The primary benefit of cMCP is providing verifiable proof that an AI agent adhered to data governance policies, preventing data leaks to tools like Snowflake or Salesforce. Unlike tunnel-based solutions, cMCP processes tool-call payloads directly within the TEE, ensuring that connectivity providers only see ciphertext. The runtime can be installed via pip and started in software mode without immediate hardware requirements, though its full security benefits are realized with TEE integration.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub cmc_internal/api GitHub github/collect GitHub agentrust-io/cmcp GitHub _private/browser GitHub get-started/accessibility GitHub open-source/sponsorsReporting from
The cMCP (Confidential MCP Runtime) has launched in developer preview, providing a secure gateway for AI agents to enforce tool-call policies within a hardware Trusted Execution Environment (TEE). This system intercepts and evaluates every tool call against a Cedar policy, blocking or redacting denied actions and generating a tamper-evident TRACE Claim as proof. It addresses security vulnerabilities in software-only policy enforcement by ensuring policy integrity and decision-making within a protected environment.