SkillFoxx

Type a name, a task or a service

1C Trusted Gateway

1С Trusted Gateway

A Windows app and MCP proxy between the agent and a 1C infobase that replaces names, tax IDs and codes with aliases before they reach the agent

MCP serverHigh riskRussian stack

alonehobo/1c-trusted-gatewayAuthor: alonehobo

Install

claude mcp add --transport http --scope user trusted-gateway http://localhost:8767/mcp

This is third-party code. Review the repository files before installing.

What it does

The gateway sits between the agent and an MCP service inside the 1C infobase and runs as a local MCP server itself. The agent runs 1C queries and code but gets aliases instead of personal names, tax IDs, serial numbers and other strings, while amounts, quantities, dates and enums stay visible. Masking decisions follow column types from metadata, with heuristics for older versions, a field allowlist and a configurable type policy. The app decrypts the agent's analysis locally so the user sees real names; in manual mode data reaches the agent only after review, and the agent can unmask extra fields only with user approval.

Who it is for. For companies that want to analyze 1C data with cloud models without handing them personal and commercial details.

Good fit when

  • You want the agent to analyze sales or stock without exposing counterparties and employees
  • Security requires control over which fields go to an external model
  • You need to review data by hand before it reaches the agent

Not a fit when

  • The workstation is not Windows
  • The agent needs real names, for example to look up a specific counterparty

Example request

Through trusted-gateway calculate revenue by counterparty for the quarter and show the top 10 by growth

Limitations

Windows 10 and 11 only. The infobase needs the MCP_Сервер.cfe extension from the release and a published hs/mcp HTTP service. Masking lowers leak risk but does not guarantee it: arbitrary 1C code output is masked heuristically. The repository has no license file.

How to disable. Remove the trusted-gateway server from the client MCP config, close TrustedGateway.exe and disable the MCP_Сервер extension in the infobase.

MCP

Transport
http
Authentication
not required

Security check

  • Runs queries and arbitrary 1C code in the live infobase
  • Masking of code output is heuristic and may miss sensitive data

README in short

The README explains how the gateway works, its requirements and quick start: download the app and extension, publish the HTTP service, connect from the localhost UI. It gives connection commands for Claude Code and Cursor and the MCP tool list. It details the three masking layers, UI modes, security measures and building from Go sources.

FAQ

Can the agent turn masking off?

Per the README, no: the server always returns masked data, and renaming fields with AS does not bypass the allowlist. The agent can unmask a field only via a suggestion the user approves.

Where are the 1C URL and token stored?

In settings encrypted with Windows DPAPI for the current user; the gateway HTTP server listens only on 127.0.0.1.

Editors’ pick

NVIDIA's open stack for running OpenClaw, Hermes and LangChain Deep Agents in OpenShell sandboxes with network policy and managed inference

CLIHigh risk22.5K
Editors’ pick

Static code analysis with rules that look like source code, plus a built-in MCP server for AI agents

CLIMedium risk16.6K

Trail of Bits skills

Trail of Bits Skills Marketplace

Editors’ pick

Trail of Bits plugin marketplace for security work: smart contracts, C/C++ and Rust review, Semgrep, CodeQL and fuzzing

PluginMedium risk7.1K

Nine skills that let an agent run Strix pentests, fix validated findings and add security scanning to CI

SkillHigh risk62.5K