# MCP self-serve eval

**Track 03** is the fastest path to governed agents: one MCP server between your IDE and every downstream tool. Blekline masks secrets and PII before they leave your machine, evaluates each tool call against workspace policy, and streams metadata-only audit events to your Blekline workspace.

No sidecar required. No cluster access. Ship one workflow this week.

## What you prove

- Prompts are masked before they reach model APIs
- Tool calls receive allow · mask · block decisions before execution
- Governance events appear in **Operations → Activity**
- Policy updates apply without redeploying local MCP config

## Prerequisites

1. A Blekline workspace — [sign up](https://app.blekline.com/auth/signup?intent=self_serve) (path chooser defaults to self-serve MCP)
2. An API key with `mask:write` and `events:write` scopes (**Admin → API keys** or **Operations → MCP**)

## Verify in the workspace

After connecting your client:

1. Open **Operations → MCP** in [app.blekline.com](https://app.blekline.com)
2. Run the live MCP connectivity test
3. Confirm `blekline_mask_prompt` and `blekline_evaluate_tool_call` respond
4. Trigger a sample tool call from your IDE — check **Activity** for the allow/mask/block record

## Downstream MCP servers

Route existing MCP servers through `@blekline/mcp-proxy` — Blekline evaluates every forwarded call with the same policy semantics.

→ [MCP proxy guide](/docs/mcp/proxy) · [MCP server reference](/docs/mcp/server)

## Client-specific guides

| Client | Guide |
|--------|-------|
| Cursor | [Cursor MCP setup](/docs/mcp/cursor) |
| Claude Code | [Claude Code setup](/docs/mcp/claude-code) |
| Claude Desktop | [Claude Desktop](/docs/mcp/claude-desktop) |
| GitHub Copilot / VS Code | [Copilot](/docs/mcp/github-copilot) |
| Continue | [Continue](/docs/mcp/continue) |

Full matrix: [Agent clients hub](/docs/integrations/agent-clients)

## Headless verify (CI)

```bash
git clone https://github.com/Blekline/blekline-oss.git && cd blekline-oss
pnpm install && pnpm build:packages
export BLEKLINE_WORKSPACE_TOKEN="blw_..." BLEKLINE_API_URL="https://app.blekline.com"
pnpm verify:integrations
```

→ [CI/CD integration](/docs/sdk/ci-cd)

## When to upgrade to platform eval

Need Trust Vault tokenization in VPC, Lineage Firewall session blocking, or fleet-wide policy SSE? Move to [Kubernetes fleet](/docs/deploy/k8s-fleet) or [Docker sidecar](/docs/deploy/docker-sidecar) after optional [NHIM audit](/docs/get-started/nhim-audit-quickstart).

---

**Try the simulator:** [Runtime Enforcement Simulator](/docs/playground/runtime-enforcement) · [Eval journey overview](/docs/get-started/eval-journey)