Concept
MCP Security
Bind each tool to a named action, check its arguments against your policy before the server runs it, and refuse any tool you have not bound. Authentication decides who may connect; a policy check decides what each call may do, and the arguments it checked are the ones that execute.
How do I enforce a policy on MCP tool calls?
Bind each tool to a named action, check its arguments against your policy before the server runs it, and refuse any tool you have not bound. Authentication decides who may connect; a policy check decides what each call may do, and the arguments it checked are the ones that execute.
- Isn't MCP authentication enough?
- No. OAuth on an MCP server tells you which client connected. It does not tell you whether this call, with these arguments, is allowed right now. Keep the authentication, and add a decision on each call that has an effect.
- Which MCP tool calls need a policy check?
- The ones with an effect: tools that pay, refund, change a price, write a record, send data out or change infrastructure. A read-only lookup usually needs no decision.
- How do I show later which tool calls an agent made?
- Record each decision when it is made: the tool, a digest of its arguments, the rule that decided it and the result. A signed record lets you show it later without relying on the logs of the system that ran the tool.
4 patterns answer this
Control MCP egress
An agent calls a tool that reaches a network destination, uploads a file, or posts data to a third party.
Its gate and signals
Gate agent memory and retrieval
An agent retrieves documents into context, or writes what it learned into durable memory.
Its gate and signals
Prevent destructive production changes
A command, script, or agent drops a table, deletes a bucket, or tears down infrastructure.
1 policy pack
Third-party data sharing
A workflow posts customer or business data to a webhook, an external API, or a vendor integration.
Its gate and signals
From this term to a governed action
- Control MCP egressThe recurring action behind this term.
- Browse the policy packsThe bundles the evaluator ships, rule by rule.
- Try to break it in the sandboxA real signed verdict, no account.
- Deploy on your surfaceAvailable on 6 platforms today.
- Verify the proof yourselfCheck the signature without trusting us.
- Start NowMeasure on your traffic before enforcing.
Where this fits
Decionis is the deterministic decision layer between intent and execution. This concept is one way in; the architecture behind it is the same in every case.