MCP proxy
Govern agents whose code you don't control, such as Claude Code, Cursor and Claude Desktop.
Put Leap360 in front of any MCP server. Every tools/call is checked and recorded; everything else passes through unchanged. It works whatever language the server is written in.
Set it up
Wrap the server's command with npx leap360 mcp-proxy. For example, to govern the GitHub MCP server in Claude Code, Cursor or Claude Desktop:
{
"mcpServers": {
"github": {
"command": "npx",
"args": ["-y", "leap360", "mcp-proxy", "--agent", "claude-code", "--",
"npx", "-y", "@modelcontextprotocol/server-github"]
}
}
}Everything after -- is the original server command. The proxy reads your key from LEAP360_API_KEY, then from the config saved by npx leap360 login.
For a remote server, wrap it with mcp-remote.
What the proxy does
- A blocked call never reaches the server. The agent gets a tool error that explains why.
- Tool output in enforce mode has credentials redacted before the model sees it, and text that looks like a prompt injection is marked as untrusted data.
- Every tool the server lists is reported, so the console can show what the agent can reach as well as what it used.
Options
| Option | What it does |
|---|---|
--agent <name> | The agent name shown in the console |
--mode shadow|enforce | Force a mode instead of following the console |
--fail-closed-at low|medium|high|critical | When Leap360 can't be reached, block calls at this risk or above |
--approval-wait <seconds> | Wait for a person to approve a held call |
--no-guard-output | Don't redact credentials or mark injections in tool output |
--api-key <key> | Use this key instead of LEAP360_API_KEY or the saved config |