cMCP, or Confidential MCP Runtime, offers a secure method for enforcing MCP tool-call policies within a hardware Trusted Execution Environment (TEE). This ensures that the agent being governed cannot tamper with the policy enforcement itself.

Launched at the Confidential Computing Summit on June 23, 2026, cMCP intercepts every tool call, evaluates it against a Cedar policy bundle, and enforces the decision within the TEE. Each session generates a signed TRACE Claim, verifiable without trusting the operator, and hardware-attested when run in a TEE. This addresses a critical gap in software-only governance, where policy integrity cannot be guaranteed.

The system measures the Cedar policy bundle hash into the hardware attestation report before execution. Tool call payloads are processed inside the TEE, with only the signed TRACE claim leaving the enclave. A quick start involves installing `pip install cmcp-runtime` and running in software mode. For enhanced security, hardware providers like TPM, AMD SEV-SNP, and Intel TDX can be utilized. Enforcement modes include 'enforcing', 'advisory', and 'silent', with 'enforcing' being the default for production environments. Configuration is managed via `cmcp-config.yaml` and environment variables like CMCP_DEV_MODE=1.