Summary

This PR introduces a SEP for an interceptor framework for the Model Context Protocol, defining a new MCP primitive that allows context operations to be intercepted, validated, and transformed at key points in the agentic lifecycle.

Motivation

The MCP ecosystem is rapidly developing a sprawling landscape of sidecars, proxies, client-wrappers and gateways to address cross-cutting context governance concerns (like PII Checking/reduction, Toxicity filtering, etc) . However, these implementations are largely:

• Non-reusable: Each solution is tightly coupled to specific deployment patterns or languages
• Non-interoperable: Different approaches don't work together, creating vendor lock-in
• Duplicative: Similar functionality is reimplemented across different tools and servers
• Fragmented: No common interface or discovery mechanism exists

Overall this is leading to an M × N problem: Each of M clients must integrate with each of N middleware solutions, resulting in M × N integration points and configurations.

What This SEP Proposes

This SEP proposes an Interceptor framework that effectively elevates middleware to an MCP primitive in-order to provide control over context at key points in the agentic lifecycle.

Towards this end, the SEP:

• Introduces a New MCP Primitive: The Interceptor, which comes in two distinct types; Validators (Dedicated to making pass/fail decisions), Mutators (Focused on payload transformations).
• Defines a Trust-Boundary-Aware Execution Model: Unlike MCP Tools, whose execution is generally non-deterministic, the Interceptor execution model is deterministic. They are invoked at specific points in the agentic lifecycle (such as tools/call) to ensure governance over context is reliably applied before it crosses trust boundaries for both the server and the client.
• Adds protocol-level methods (interceptors/list and interceptor/invoke) that allow clients and servers to dynamically discover and trigger these primitives.

Important: The SEP is fully backward compatible, interceptors are an optional server capability, no existing protocol methods are modified, and clients that do not support interceptors continue to work unchanged.

Other Relevant material

Relevant MCP Dev Summit (2016) Talks:

• Interceptors for MCP: A Production-Tested Standard for Agentic Middleware
• Context Middleware for MCP: From Enterprise Needs To Protocol Extension

Reference Implementations (WIP):

• https://github.com/modelcontextprotocol/experimental-ext-interceptors