Hangar is a policy enforcement plane for MCP on Kubernetes.
Admission policy per server. Egress rules per tool call. An audit trail that names who did what.
Deterministic — no ML. Self-hosted — no SaaS. MIT.
A call denied on purpose
apiVersion: mcp-hangar.io/v1alpha2
kind: MCPEgressPolicy
metadata:
name: gh-readonly
spec:
mode: Enforce
targetRef:
kind: MCPServer
name: github
defaultAction: Deny
upstreams:
- name: github
match:
host: api.github.com
tools:
allow: ["get_*", "list_*"]The policy allows two read patterns, so the write is refused before it reaches GitHub — and the refusal is recorded against the caller who made it.
The same verdict, on a laptop
No cluster, no operator. A pin is the fingerprint of the tool you approved; when the description changes, the call stops —five minutes, start to refusal.
MCP is getting a registry, tasks, and interceptors. Nothing in the protocol enforces anything. That's not a bug — it's a layering decision. Hangar is the layer.
No anomaly scores to tune, no baseline to train. If your platform team can review a NetworkPolicy, they can review a Hangar policy.
A detector produces a signal, and a signal is a question. Someone has to triage it, decide whether it was real, and act after the fact.
A policy produces a verdict, and a verdict is an answer. The tool call is allowed or it is not, before it reaches anything.
How it works
Every call arrives on the same path and meets the same gates, in the same order, whatever the agent and whatever the backend.
What a call meets inside, in order
What you do with it
Expose only the tools a caller should see, and hold the dangerous ones for a human. Both decisions are per server and per tool, and both are recorded against the identity that triggered them.
mcp_servers:
github:
tools:
allow_list: ["github.get_*", "github.list_*"]
approval_list: ["github.create_issue"]A tool's schema — its name, description and input/output shape — is fingerprinted with SHA-256 over its canonical form (RFC 8785). If an upstream quietly changes what a tool accepts, the call fails closed instead of running against the new shape.
mcp_servers:
payments:
tool_projection:
digest_enforcement: blockDistinct from container image digest pinning, which the operator does separately at admission time.
The last gate before the wire. An egress policy decides which upstreams a server may reach and which tool calls it may make — down to the arguments — and it is evaluated inside the tool invocation, immediately before any outbound I/O happens.
End-to-end enforcement needs core v1.6.0+ and operator v0.14.0+; the operator ships the MCPEgressPolicy CRD and its controller.
apiVersion: mcp-hangar.io/v1alpha2
kind: MCPEgressPolicy
metadata:
name: payments-egress
spec:
mode: Enforce
targetRef:
kind: MCPServer
name: payments
defaultAction: Deny
upstreams:
- name: payments
match:
host: api.payments.internal
tools:
allow: ["get_*"]
deny: ["refund"]Every call is written down with the caller attached — allowed and denied alike. A verdict nobody can attribute proves nothing, so identity travels with the record rather than being reconstructed afterwards.
Exportable as CEF, LEEF, JSONL and RFC 5424 syslog. OTLP is a separate trace and audit-span path, not a SIEM format.
Since 2.5.0
Until 2.5.0 the honest answer to can I run two of them was no — run one and make its restart fast. Now a replica set shares one PostgreSQL and agrees with itself.
A single instance holds the management lease. Discovery, deregistration and the other estate-wide moves happen there, so two replicas cannot undo each other's work.
The lease carries a generation, and a convergence loop's deregistration carries it into the write, so a superseded holder affects zero rows. Re-registering and metric snapshots rest on local belief, where a repeat costs nothing.
State is an event log the replicas follow, so a server registered on one is visible to the rest instead of living in one instance's memory.
The detail that makes it correct: a follower cannot assume events become visible in the order they were numbered. A lower-numbered event can commit after a higher-numbered one, so a reader that trusted the numbering would step straight over it and never come back. The tail waits for the point past which no earlier write can still appear.
What it takes to run more than oneGoverned async tasks
The export, the migration, the bulk write — everything expensive and hard to undo hands back a handle in milliseconds and does the real work later. Hangar governs the relay of that task, and the moment it pauses for input, without ever becoming the executor.
TLS and custom CAs, SSRF refused at registration and re-checked on connect, JWKS-validated identity, rate limiting, value-level secret redaction — and the standards behind them, mapped against the OWASP MCP Top 10 including the three categories Hangar deliberately does not cover.
Security, in fullWhere to go next, depending on why you came.
Install the Python core, put a policy in front of one MCP server, and watch a call get denied on purpose.