MCPOne

About this project

• •Regulated environments cannot send a prompt to a model and hope for the best. MCPOne sits between the application and the provider, screening every request against policy, and keeping a record that survives an audit.
• •Requests arrive over REST, gRPC or MCP and pass through inline PII redaction plus prompt-injection and content-safety scans. Everything that happens is written to an append-only, hash-chained audit ledger in PostgreSQL, so a tampered record breaks the chain.
• •I designed a guardrail enforcement engine that maps a 1,248-rule catalog onto real runtime mechanisms: 36 gateway gates, 42 per-request runtime gates, and 192 infrastructure attestations. An autonomous cron agent adversarially re-tests the live production guardrails every hour across six harm categories, so drift shows up as a failure rather than a surprise.
• •The multi-tenant SaaS streams over SSE through a five-tier LLM router: bring-your-own-key, then credits, then local Gemma via Ollama, then managed Gemini, then a canned fallback. Auth via next-auth, metered billing via Stripe.
• •Deployed via GitHub Actions CI — build, typecheck, test, Trivy scan — with Drizzle migrations and PM2 reloads. MCPOne was assessed as Awardable by Tradewinds.

Key Features

• •Every request screened before it reaches a model
• •Append-only, hash-chained audit ledger
• •1,248-rule catalog mapped to mechanisms that actually run
• •Hourly adversarial re-test of live production guardrails
• •Five-tier LLM router so cost never blocks a request
• •Metered billing and multi-tenant auth

Technologies Used