MCP Gateway Policy Pack

Why this page exists. The control plane says what a workflow is allowed to do. The gateway policy pack turns that into a portable enforcement contract an MCP gateway, agent host, CI admission check, or policy sidecar can load directly.

Rechecked August 23, 2026: MCP 2026-07-28 is still current and stateless. There is no negotiation handshake. Each request carries protocol version and capabilities. Servers MUST implement server/discover. kill_session here is a host-session kill switch, not Mcp-Session-Id. Streamable HTTP revisions through 2025-11-25 could assign that header; 2026-07-28 ignores it and does not mint session IDs.

The product bet

Agentic remediation cannot scale on prompt discipline alone. Enterprise reviewers need a boring answer to a hard question: “What prevents this agent from using the wrong tool, touching the wrong file, or continuing after its scope has changed?”

The policy pack is that answer. It makes the site more than a library of instructions by creating a machine-readable layer that can sit between AI agents and enterprise systems:

  • Agents get a simple decision contract instead of paragraphs of policy.
  • Gateways get explicit scopes, path limits, labels, and runtime kill signals.
  • Reviewers get evidence requirements that are consistent across tools.
  • Platform teams get one artifact they can pin, diff, and promote.

This is the shape a reviewer can underwrite: recipes for adoption, manifests for governance, policy for enforcement, and evidence for audit.

Workflow at a glance

MCP Gateway Policy Pack workflow

Evaluate MCP calls against workflow, client, identity, connector, tool, argument, resource, data, approval, and rate policies.

mcp-governance

  1. Signal

    Intercept the MCP request

    Capture client, identity, tenant, workflow, run, server, tool/resource/prompt, arguments, data, and purpose.

  2. Scope

    Resolve trust and scope

    Load connector registry, authorization, entitlement, workflow manifest, context, tool risk, approval, and session state.

  3. Decision

    Evaluate policy rules

    Check allowed capability, argument/path bounds, destination, data class, side effects, rate, sequence, and hard-stop signals.

  4. Action

    Enforce the gateway decision

    Allow, rewrite/minimize, require approval, hold, deny, revoke, or kill before forwarding the call.

  5. Proof

    Emit decision evidence

    Record reason, policy, evidence hashes, transformed request, response status, correlation, and telemetry.

Decision gate

Is this exact MCP capability and request authorized for the bound workflow, identity, connector, data, and session state?

Proceed

Forward only the approved minimized request and record its result.

Hold or stop

Hold, deny, revoke, or kill overbroad, unauthorized, destructive, or prohibited calls.

Evidence to retain

  • bound request/trust context
  • policy rule evaluation
  • gateway decision and result receipt

Expected outputs

  • MCP gateway decision
  • approval request
  • deny/kill event

What was added

The policy pack is generated from the workflow control-plane manifest:

  • data/policy/mcp-gateway-policy.json - the generated policy bundle.
  • scripts/generate_mcp_gateway_policy.py - the deterministic compiler from workflow manifests to gateway policy.
  • scripts/evaluate_mcp_gateway_decision.py - the runtime pre-call and mid-run policy evaluator.
  • recipes_mcp_gateway_policy - an MCP tool that exposes the pack to connected agents and gateways.

Regenerate the policy and fail CI on drift:

python3 scripts/generate_mcp_gateway_policy.py
python3 scripts/generate_mcp_gateway_policy.py --check

Evaluate a declared read-only tool call:

python3 scripts/evaluate_mcp_gateway_decision.py \
  --workflow-id vulnerable-dependency-remediation \
  --agent-id sr-agent::vulnerable-dependency-remediation::codex \
  --agent-class codex \
  --run-id run-ci \
  --tool-namespace advisories.vulnerability \
  --tool-access-mode read \
  --gate-phase tool_call \
  --expect-decision allow

The manifest cannot change without updating the generated enforcement contract.

Policy decisions

Every workflow policy defaults to deny. A gateway should allow only the declared decisions:

Decision Meaning
allow Read-only context access inside the declared MCP namespace.
allow_scoped_branch Write only to the workflow branch prefix and declared file scope.
allow_scoped_ticket Write workflow evidence or triage notes only to declared ticket systems.
hold_for_approval Pause and require a typed human approval record before continuing.
deny Fail closed for undeclared workflows, tools, paths, hosts, or gates.
kill_session Disable the active agent session when a runtime kill signal fires.

The generated pack also carries the runtime attributes an enforcer needs to make those decisions: workflow ID, agent ID, run ID, tool namespace, access mode, branch name, changed paths, diff size, gate phase, and human approval record.

How gateways use it

An MCP gateway or agent runtime should apply the pack as a pre-call and mid-run control:

  1. Load the policy pack at startup and pin its source_manifest.sha256.
  2. Match the incoming run to workflow_id.
  3. Reject the run if the workflow is missing, paused, retired, or outside its declared maturity posture.
  4. For each tool call, match tool_namespace and requested access mode against allowed_mcp_scopes.
  5. For each proposed file write, enforce allowed_paths, forbidden_paths, max_changed_files, and max_diff_lines.
  6. For each gate transition, require the phase rules and evidence records declared by the workflow.
  7. Kill the session when any runtime kill signal fires.

The policy pack is intentionally vendor-neutral. It can be converted into OPA/Rego, Cedar, a gateway-native rule format, or a simple in-process decision table. The important part is that the source of truth is the same artifact agents can retrieve and auditors can review.

Industry alignment

This feature is aligned with the controls serious AI security programs are already converging on:

  • MCP Security Best Practices calls out MCP-specific attack paths such as confused deputy and token passthrough risk. A gateway policy pack keeps tool access scoped and auditable.
  • MCP Authorization requires token audience validation and explicit authorization handling for HTTP transports. The pack gives operators the workflow-level authorization context those checks need.
  • OWASP Top 10 for Agentic Applications highlights goal hijacking, tool misuse, and identity or privilege abuse as core agentic risks. The pack narrows tool use and fails closed on undeclared actions.
  • NIST AI RMF frames trustworthy AI around govern, map, measure, and manage functions. This pack operationalizes those functions for remediation workflows.
  • CISA Secure by Design pushes measurable security outcomes and executive ownership. Generated, versioned policy is a measurable control, not a slide.
  • Open Policy Agent popularized decoupling policy decisions from application logic. The pack follows that model while staying neutral about the final policy engine.

Enterprise checklist

Before promoting a workflow to broad rollout, require:

  • The workflow manifest validates cleanly.
  • The gateway policy pack is regenerated and --check passes in CI.
  • The MCP gateway denies undeclared namespaces by default.
  • The gateway records every hold, denial, and kill-session decision with run ID attribution.
  • Human approvals are typed records, not chat messages.
  • The policy pack hash is attached to PR evidence or the run log.

That is the difference between “the prompt said no” and “the platform could not do it.”

See also