# SpotAgentIQ

> SpotAgentIQ is an open-source (Apache-2.0) MCP proxy that sits between an AI agent and the MCP servers it calls. A short JSON policy decides whether each tool call is allowed, held for human approval, or denied. Every decision is written to a SHA-256 hash-chained audit log that can be verified offline. It ships as one static Go binary with no dependencies. SpotAgentIQ Cloud, a hosted control plane for team approvals, is in early access.

Key facts:
- Works with any MCP client: Claude Desktop, Claude Code, Cursor, custom agents.
- Agents see the same tool names; no agent code changes.
- Rules match tool names by glob, can be scoped per upstream server, and can test arguments with a regex.
- Held calls appear in a local web inbox and optionally in Slack.
- "spotagentiq verify" detects edited, inserted or deleted log lines.
- Source: https://github.com/mckoy-labs/spotagentiq

## Docs

- [Quickstart](https://www.spotagentiq.com/docs): install, configure, connect an MCP client
- [Policies](https://www.spotagentiq.com/docs/policy): rule syntax, matching, argument patterns, redaction
- [Audit log](https://www.spotagentiq.com/docs/audit-log): event types, fields, hash chain, verify and export
- [Reference](https://www.spotagentiq.com/docs/reference): config fields, CLI, HTTP API, Docker

## Guides

- [MCP security](https://www.spotagentiq.com/mcp-security)
- [Human-in-the-loop approval for AI agents](https://www.spotagentiq.com/human-in-the-loop-ai-agents)
- [AI agent audit trails](https://www.spotagentiq.com/ai-agent-audit-trail)

## Optional

- [Cloud early access](https://www.spotagentiq.com/cloud)
- [Blog](https://www.spotagentiq.com/blog)