prompt-compass-mcp

<p align="center">
  <img src="logo.png" width="160" height="160" alt="Prompt Compass logo">
</p>

# Prompt Compass MCP

Prompt Compass gives MCP-compatible AI clients one decision-only tool for
checking prompts before they are forwarded:

- `LOCAL_SAFE` - suitable for the user's configured local-model route.
- `CLOUD_COMPLEX` - suitable for the user's configured cloud-model route.
- `BLOCK_PII` - contains likely personal or sensitive data.
- `JAILBREAK` - contains likely prompt-injection or jailbreak content.

The MCP server does not call an AI model, choose a model provider, or execute
actions. The host application remains in control.

## Install

Requires Node.js 20 or newer and a Prompt Compass API key.

```text
npx -y @mpcfintech/prompt-compass-mcp
```

Set the key as `PROMPT_COMPASS_API_KEY`. Keep it out of source control,
screenshots, issue reports, and chat messages.

Clients supporting Streamable HTTP can instead connect to:

```text
https://api.mpcfintech.com/mcp
```

Modern clients can discover Prompt Compass OAuth automatically from that URL.
Choose **Connect** or **Sign in**, log in with your Prompt Compass account, and
approve the single read-only prompt-check permission. No API key needs to be
pasted into the client. Clients without OAuth support can still use
`Authorization: Bearer YOUR_PROMPT_COMPASS_API_KEY`.

Detailed setup for Codex, ChatGPT desktop, Claude Code/Desktop, Cursor, Cline,
Windsurf, Gemini CLI and Google Antigravity is in
[`CLIENT_SETUP.md`](CLIENT_SETUP.md).

## Exposed tool

### `compass_check_prompt`

Input:

```json
{ "prompt": "Text to check" }
```

The result is a routing/firewall decision only. The tool is marked read-only,
non-destructive and idempotent.

## Plans and keys

Create a Prompt Compass account and API key at:

https://compass.mpcfintech.com

The MCP connection uses the same quota and billing pool as the Prompt Compass
REST API. There is no separate MCP surcharge.

## Security and limitations

Prompt Compass is a decision aid, not a sandbox or security guarantee. Keep
the host client's own permissions, confirmation prompts, provider policies and
application-level validation enabled. Do not auto-approve third-party tools.

Agent Compass is not included in this release.

## Test

```text
npm install
npm test
```

The public test uses a local in-memory MCP transport and a simulated API
response. It does not require a customer key.

## Links

- Product: https://mpcfintech.com/compass
- Dashboard: https://compass.mpcfintech.com
- Terms: https://mpcfintech.com/legal/terms
- Privacy: https://mpcfintech.com/legal/privacy

Copyright (c) Madanpotra Consultancy Private Limited.