MCP Server Guardrails & Tool Authorization

The Model Context Protocol (MCP) provides a standard interface for Large Language Models to discover and invoke tools, query external databases, and interact with APIs. However, leaving tool execution decisions to the language model itself creates severe security vulnerabilities: prompt injection, indirect jailbreaks, and confused-deputy attacks can trick an LLM into calling destructive tools without human oversight. TRUSTIVAN places a deterministic, policy-enforcing authorization proxy outside the LLM context window.

Why the Model Is Never the Boundary

[User / External Input]
         |
         v
+------------------+         Tool Call Request        +-------------------------+
|     LLM Agent    |  ----------------------------->  | TRUSTIVAN Runtime Gate  |
|  (Untrusted Boundary)                               |   (13 Deterministic     |
+------------------+                                  |    Deny-by-Default      |
                                                      |        Rules)           |
                                                      +------------+------------+
                                                                   |
                                              +--------------------+--------------------+
                                              |                    |                    |
                                              v                    v                    v
                                          [ ALLOW ]          [ CHALLENGE ]           [ DENY ]
                                              |                    |                    |
                                              v                    v                    v
                                         Execute Tool       Dual-Approval          Block Action &
                                         on MCP Server      Access Grant           Alert Team

When an agent runtime invokes a tool, TRUSTIVAN verifies:

Identity & Lifecycle: Is the calling agent active and free of security quarantine?
Credential Integrity: Is the runtime token valid and bound to this agent?
Explicit Tool Entitlement: Does this specific agent have explicit permission to execute this tool?
Action Classification: Is the tool read-only, mutating (write), or administrative?
Resource Blast Radius: Is the target resource classified as high-impact or critical?
Autonomy & Oversight: Does the agent’s declared autonomy level permit unsupervised execution?

If any check fails, TRUSTIVAN answers with challenge or deny—preventing unauthorized execution regardless of what the prompt instructed.

Connecting an MCP Tool Server

The MCP connector inspects an MCP server using the standard protocol handshake (initialize followed by tools/list). It collects published tools, their descriptions, and publisher hints. Register an MCP server via the API:

curl -s -X POST https://app.trustivan.com/nhi/api/v1/connectors \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "mcp",
    "name": "Database Operations MCP Server",
    "scope": {
      "kind": "instance",
      "id": "mcp-db-ops-prod"
    },
    "endpoint": "https://mcp-gateway.corp.internal/v1/sse",
    "settings": {
      "authMode": "bearer",
      "protocolVersion": "2025-06-18",
      "pageSize": 100
    },
    "enabledCapabilities": [
      "tool_discovery",
      "resource_discovery",
      "relationship_discovery"
    ]
  }'

Authentication Modes

bearer (Recommended): Uses a token registered in your deployment configuration. The connector only requires permissions to list tools—never to execute them.
none: Used only for unauthenticated, internal development servers.

Declaring Action Classes & Tool Effects

MCP tools declare annotations such as readOnlyHint. However, because third-party MCP servers cannot be blindly trusted, TRUSTIVAN requires explicit administrator classification:

Action Class	Meaning	Example Tools	Default Policy Behavior
`read`	Non-mutating observation	`query_read_only`, `fetch_logs`, `list_records`	Allowed if agent is entitled
`write`	Mutates data or infrastructure	`update_record`, `commit_patch`, `send_email`	Challenged if resource is critical or agent autonomy undeclared
`administrative`	Destructive or privilege changes	`drop_table`, `grant_role`, `rotate_key`	Always challenged; requires time-bounded access grant
`unknown`	Unclassified tool	Any tool missing verified effect	Treated as potentially mutating; fails closed

Set or update a tool’s effect:

curl -s -X PATCH https://app.trustivan.com/nhi/api/v1/tools/{toolId}/effect \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "effect": "write",
    "notes": "Updates database records within production tenant schemas"
  }'

Granting Tool Entitlements

By default, an agent has zero tool entitlements (tool_not_entitled denies all invocations). An administrator must explicitly map which agent identities may invoke each tool:

curl -s -X POST https://app.trustivan.com/nhi/api/v1/tools/entitlements \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "identityId": "agent-support-copilot",
    "toolId": "tool-ticket-lookup",
    "maxActionClass": "read"
  }'

Runtime Mediation in Action

When your AI agent runtime receives a tool call from the LLM, call POST /api/v1/mediation:

curl -s -X POST https://app.trustivan.com/api/v1/mediation \
  -H "Authorization: Bearer $AGENT_RUNTIME_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "requestedOperation": "tickets.updateStatus",
    "declaredActionClass": "write",
    "toolKey": "mcp.support.update_ticket",
    "resourceKey": "zendesk:ticket/49201",
    "intent": "Mark customer ticket resolved after verifying refund",
    "requestId": "call-uuid-9841"
  }'

Handling the Mediation Response

{
  "id": "med-01J9...",
  "decision": "allow",
  "effectiveActionClass": "write",
  "rulesEvaluated": [
    { "rule": "principal_not_live", "verdict": "allow" },
    { "rule": "principal_quarantined", "verdict": "allow" },
    { "rule": "credential_not_usable", "verdict": "allow" },
    { "rule": "tool_not_entitled", "verdict": "allow" },
    { "rule": "tool_effect_unclassified", "verdict": "allow" },
    { "rule": "mutating_action_on_high_impact_resource", "verdict": "allow" }
  ],
  "reason": null,
  "requestId": "call-uuid-9841",
  "recordedAt": "2026-09-27T05:30:00Z"
}

If the decision is allow, the agent runtime proceeds to forward the call to the MCP server. If the decision is challenge: The runtime pauses execution and requests a human approval grant (POST /api/v1/access-grants). Once an Organization Admin approves, the next check allows the operation. If the decision is deny: The runtime immediately stops and reports the refusal to the user without calling the tool.

Reporting Execution Outcomes

To maintain a tamper-evident audit history of real executions, report the outcome once completed:

curl -s -X POST https://app.trustivan.com/api/v1/mediation/{mediationId}/outcome \
  -H "Authorization: Bearer $AGENT_RUNTIME_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "outcome": "succeeded"
  }'

Best Practices for MCP Security

Never pass unrestricted credentials to MCP servers: Agents should never receive raw API keys or database passwords. Use ephemeral, scoped credentials managed by TRUSTIVAN.
Classify destructive tools as administrative: Any tool capable of deletion, credential issuance, or privilege escalation must require dual-approval access grants.
Log replay-safe request IDs: Always supply requestId to prevent network retry duplication.
Isolate MCP network endpoints: Deploy MCP servers in isolated VPCs or internal subnets accessible only via the TRUSTIVAN mediation proxy.

Get started

Inventory

Govern

Reference

MCP Server Guardrails & Tool Authorization

Why the Model Is Never the Boundary

Connecting an MCP Tool Server

Authentication Modes

Declaring Action Classes & Tool Effects

Granting Tool Entitlements

Runtime Mediation in Action

Handling the Mediation Response

Reporting Execution Outcomes

Best Practices for MCP Security

​Why the Model Is Never the Boundary

​Connecting an MCP Tool Server

​Authentication Modes

​Declaring Action Classes & Tool Effects

​Granting Tool Entitlements

​Runtime Mediation in Action

​Handling the Mediation Response

​Reporting Execution Outcomes

​Best Practices for MCP Security

Why the Model Is Never the Boundary

Connecting an MCP Tool Server

Authentication Modes

Declaring Action Classes & Tool Effects

Granting Tool Entitlements

Runtime Mediation in Action

Handling the Mediation Response

Reporting Execution Outcomes

Best Practices for MCP Security