arbitusgateway

Arbitus — Security skill for Claude Code

Security community

Open-source security gateway for MCP tool calls — blocks secret leaks, enforces agent policies, and requires human approval for risky actions.

How to install Arbitus

This entry records only its repository, not the path inside it, so there is no exact command to give. Open arbitusgateway/arbitus and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Arbitus does

Open-source security gateway for MCP tool calls — blocks secret leaks, enforces agent policies, and requires human approval for risky actions.

Alternatives in Security

ThinkWatch — Self-hosted AI API and MCP gateway for organizations: SSO and RBAC, per-user identity for MCP tool calls, PII 817 ★
OpenTag — Open-source, channel-native agent gateway for Slack 499 ★
Memory Self Review — Mine recent agent history (claude-mem + usage stats) for recurring failures and repeated patterns, audit MEMOR 297 ★

README

Arbitus

[![crates.io](https://img.shields.io/crates/v/arbitus.svg)](https://crates.io/crates/arbitus) [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [![CI](https://github.com/arbitusgateway/arbitus/actions/workflows/ci.yml/badge.svg)](https://github.com/arbitusgateway/arbitus/actions/workflows/ci.yml)

Open-source firewall for MCP tool calls. Arbitus sits between AI agents and MCP servers, then blocks secret leaks, dangerous tools, runaway loops, and unapproved actions before requests reach upstream.

Agent (Claude Code, Cursor, OpenAI Agents SDK, etc.)
        │  JSON-RPC
        ▼
      arbitus     ← auth, rate limit, HITL, payload filter, audit
        │
        ▼
  MCP Server (filesystem, database, APIs...)

Use it when you want developers to keep using AI agents without giving every agent unrestricted access to your filesystem, databases, internal APIs, or production tools.

![Arbitus blocks secret exfiltration](docs/assets/secret-leak-demo.gif)

Why teams use it

Stop secret exfiltration — block or redact .env values, API keys, private keys, bearer tokens, and encoded variants before they leave the agent runtime
Constrain agent tools — expose only approved tools through tools/list, then enforce the same policy on tools/call
Control blast radius — rate-limit agents per minute, per tool, and per IP so loops do not become budget or infrastructure incidents
Approve risky actions — require Human-in-the-Loop approval before writes, deletes, deploys, database mutations, or shell-like tools run
Keep an audit trail — record every decision with request IDs and send events to SQLite, webhooks, CloudEvents, OpenLineage, Prometheus, or OTLP backends