Back to Browse

Raposa MCP Server

Developer ToolsModerate5.7MCP RegistryLocal
Free

Server data from the Official MCP Registry

Human approval for AI agents: a named person approves or rejects, silence is not consent.

About

Human approval for AI agents: a named person approves or rejects, silence is not consent.

Security Report

5.7
Moderate5.7Moderate Risk

Raposa MCP is a well-designed human-approval tool with solid security practices. Authentication via API key is properly enforced, secrets are never exposed in outputs, and input validation prevents common misuse. The server has appropriate permissions for its use case (network_http for API calls, env_vars for credential storage) and includes comprehensive contract tests demonstrating safe behavior. Minor code quality observations around broad exception handling do not materially impact security. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 5 high severity). Package verification found 1 issue.

5 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

What You'll Need

Set these up before or after installing:

Raposa Aval API key (free sandbox key at https://raposa.group/start/)Required

Environment variable: RAPOSA_API_KEY

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "group-raposa-raposa-mcp": {
      "env": {
        "RAPOSA_API_KEY": "your-raposa-api-key-here"
      },
      "args": [
        "raposa-mcp"
      ],
      "command": "uvx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

raposa-mcp

An MCP server that gives your agent one honest tool: ask a human.

request_human_approval(action, context, risk) -> { approved: true|false, decided_by, ... }

approved is true only when a named person pressed Approve. A timeout, an expiry or a rejection all return approved: false — silence is not consent. Every decision is sealed in Raposa's hash-chained audit log, exportable for an auditor. EU-hosted, DPA available.

Install

{
  "mcpServers": {
    "raposa": {
      "command": "uvx",
      "args": ["raposa-mcp"],
      "env": { "RAPOSA_API_KEY": "<your key>" }
    }
  }
}

Claude Code: claude mcp add raposa -e RAPOSA_API_KEY=<your key> -- uvx raposa-mcp

Get a free sandbox key (100 approvals a month) at https://raposa.group/start/ — it arrives by email in a minute.

Tools

ToolWhat it does
request_human_approval(action, context, risk, requested_by?, wait_sec=600, expires_in_sec?)creates the request and waits for a human; returns approved
create_approval(action, context, risk, requested_by?, expires_in_sec?, webhook_url?)returns the id at once; decision arrives on the HMAC-signed webhook or via get_approval
get_approval(approval_id)reads one approval

risk is low | medium | high. The API key is read from RAPOSA_API_KEY only and never appears in tool inputs or outputs. Base URL override: RAPOSA_API_BASE (default https://dcescrypt.com/api).

Who approves

The people on your team who hold the approve button get a scoped console login and, if you give us their email, every request also reaches them as a mail with signed Approve / Reject links. Their name is recorded on the decision. Docs: https://raposa.group/docs/#approvers

Develop

pip install -e ".[test]" && pytest -q

MIT · DC ESCRYPT SL · contact@raposa.group

Reviews

No reviews yet

Be the first to review this server!