Architecture Overview

MCPDome is a Rust workspace of 8 focused crates:

Crate	Responsibility
dome-core	Shared types & error taxonomy
dome-transport	MCP wire protocol (stdio, HTTP+SSE)
dome-gate	Interceptor chain orchestration
dome-sentinel	Authentication & identity resolution
dome-policy	TOML policy engine (default-deny)
dome-ledger	Hash-chained audit logging
dome-throttle	Token-bucket rate limiting & budgets
dome-ward	Injection detection & schema pinning

Interceptor Chain

Every inbound message passes through this chain in order:

sentinel → throttle → policy → ward → ledger → upstream server

Outbound responses pass through:

schema-pin → ledger → client

If any interceptor rejects the message, processing stops and an error response is returned to the client.