cMCP（Confidential MCP Runtime）是一个新推出的开源网关项目，旨在为AI代理的工具调用提供可验证的控制机制[1]。该项目在2026年6月23日的Confidential Computing Summit上亮相[1]，通过在硬件可信执行环境内部署Cedar策略引擎来拦截和评估每个工具调用[1]。当调用被处理后，系统会生成带有硬件证明的签名TRACE凭证，确保AI代理的操作被正确控制且可独立验证[1]。
cMCP支持多种硬件TEE环境，包括TPM 2.0/vTPM、AMD SEV-SNP、Intel TDX和OPAQUE[1]。该项目采用MIT许可证开源发布，用户可通过pip install cmcp-runtime快速安装[1]。为了便于开发测试，项目还提供了软件模式，通过设置CMCP_DEV_MODE=1环境变量可在无硬件TEE的情况下运行[1]。对于需要验证系统可信性的场景，用户可利用cmcp_verify库来验证签名、策略哈希和完整的审计链，从而有效应对不信任的运营者[1]。
A new open-source project called cMCP (Confidential MCP Runtime) has been introduced to address the challenge of controlling and verifying AI agent tool calls through hardware-backed cryptographic guarantees [1]. Unveiled at the Confidential Computing Summit on June 23, 2026, the project executes MCP tool invocation policies within a hardware trusted execution environment (TEE), intercepting each tool call, evaluating it against Cedar policy rules, and generating cryptographically signed TRACE credentials with hardware attestation [1].
The system supports multiple hardware TEE platforms, including TPM 2.0/vTPM, AMD SEV-SNP, Intel TDX, and OPAQUE [1]. For development and testing purposes, developers can run cMCP in software mode by setting the CMCP_DEV_MODE environment variable to 1, eliminating the requirement for physical hardware [1]. The project is distributed under the MIT license and can be installed via the command pip install cmcp-runtime [1].
To verify the integrity of tool call execution and policy enforcement even when dealing with potentially untrusted operators, users can employ the cmcp_verify library to validate signatures, policy hashes, and audit trails [1].