cco

CCO-MCP provides a real-time auditing and approval layer between Claude Code tool calls and your environment. It acts as a firewall, showing you all tool invocations as they happen and allowing you to approve or block actions on the fly. The web dashboard updates in real time via Server-Sent Events, giving you visibility into agent identity, tool parameters, and the current approval status. You can configure smart auto-approval rules to streamline safe operations (for example, file reads) while requiring manual review for more sensitive actions like executing shell commands. The system is designed to scale as you run many Claude Code instances in the background, reducing the “tab-switching fatigue” of monitoring separate processes.

To get started, deploy CCO-MCP with Docker Compose as described in the Getting Started section, then open the dashboard at the configured port (default 8660). In Claude Code, register CCO-MCP as an MCP server (commonly via the http type and the URL http://localhost:8660/mcp). You can enable approval prompts by running Claude Code in non-interactive mode with the permission-prompt-tool flag pointing to the CCO-MCP instance so that Claude asks for approval through the dashboard before executing sensitive operations.

You can configure default actions, timeouts, and per-rule behavior through the web UI. Rules support tool matching (including built-in tools and MCP server tools), agent-based matching, and wildcards, with actions set to auto-approve or auto-deny. The audit logs capture complete context for each tool call, providing a traceable history for security reviews and compliance.

Prerequisites

• Docker and Docker Compose installed on the host
• Git to clone the repository

Installation steps

1. Install Docker and Docker Compose on your system if not already installed.
2. Clone the MCP server repository: git clone https://github.com/onegrep/cco-mcp.git cd cco-mcp
3. Start the MCP server using Docker Compose: docker compose up -d // If your environment uses the legacy docker-compose command, you may run: // docker-compose up -d
4. Open the dashboard in your browser
   • By default, the dashboard is served on port 8660. Visit http://localhost:8660 to access it.
5. Configure Claude Code to use CCO-MCP
   • In Claude Code, add an MCP server with type http and URL http://localhost:8660/mcp as shown in the README configuration example.
6. Optional: enable non-interactive permission prompts in Claude Code
   • Run Claude Code with the appropriate permission-prompt-tool, e.g. using the mcp__cco-mcp__approval_prompt tool if supported by your setup.

Notes

• If you change ports, adjust the PORT environment variable accordingly and update Claude Code configurations to reflect the new URL.

Environment variables to be aware of:

• PORT: Server port for the MCP dashboard (default: 8660). If you change it, ensure Claude Code configurations are updated to point at http://<host>:<port>/mcp.
• CCO_CONFIG_PATH: Path to the CCO-MCP configuration file if you’re using a file-based setup; the UI typically handles config, but environment variables can be used for advanced deployments.

Common issues:

• If the dashboard cannot be reached, verify Docker is running and that the MCP container is up (docker ps). Check the logs with docker logs <container_id>.
• Ensure your firewall or reverse proxy allows traffic to the configured port.
• When using Docker Compose, ensure the correct compose file is in use (docker compose vs docker-compose).

Tips:

• Use the web UI to define default actions, timeouts, and approval rules for different tools and agents.
• The audit logs are searchable; use them to audit behavior and refine rules over time.