Intercept gives your team hard limits over every MCP tool call. Rate limits, spend caps, approval workflows, access controls, audit logs. One YAML file. No agent changes.
npx -y @policylayer/intercept go install github.com/policylayer/intercept@latest Nine tool calls in nine seconds. On the left, everything goes through. On the right, Intercept is running.
There's no built-in way to make tools read-only, cap spend, require approval, or stop a runaway loop. You have to define that yourself.
You can't cap daily refunds or rate limit by default. Every call goes through.
No read-only mode. Every tool can write. You can't restrict queries to specific schemas out of the box.
No built-in retry limits or resource caps. A loop runs until you notice.
Intercept sits between your agent and the MCP server. Every tool call is evaluated against your policy file before execution -- then allowed, denied, held for approval, or logged.
Commit it to your repo. Deploy it with your agent. The file is the policy.
version: "1" default: deny hide: - delete_repository - merge_pull_request tools: create_refund: rules: - name: "daily cap" rate_limit: 10/day issue_refund: rules: - name: "large refunds" action: require_approval approval_timeout: 10m write_file: rules: - name: "safe paths" conditions: - path: "args.path" op: "regex" value: "^/app/src/"
No architecture changes. One line in your MCP config.
See which tools can write, delete, spend, or execute before your agent uses them.
intercept scan -o policy.yaml \ -- npx -y @stripe/mcp-server
Start from a generated policy, then tighten it for your use case. Add rate limits, approval rules, and access controls in YAML. Commit it to your repo.
Run Intercept in front of the MCP server. Every call is checked before execution and every decision is logged.
intercept -c policy.yaml \ -- npx -y @stripe/mcp-server
Invisible until a limit is hit. Completely transparent about why when one is.
If Intercept goes down, nothing runs. Your agent doesn't get a free pass.
Push a policy change without restarting. Useful when you're tightening limits mid-incident.
Policy checks run in-process. No network calls. No latency hit. Your agent doesn't know it's there.
Every tool call logged: what was called, what the decision was, what rule fired. Reconstruct exactly what happened.
One Go binary. No runtime. No dependencies. Runs on anything.
Hold sensitive actions for human approval. One-time use, fingerprinted, audited, with optional webhook notifications.
Generate a starting policy from your MCP setup. Tighten the rules. Carry the same file from development into production.
An open-source MCP proxy that enforces policy on tool calls before they execute. Intercept lets you scan risk, generate a YAML policy, and block dangerous actions or hold them for human approval without changing your agent. One line change in your MCP config.
Tool access, spend, call volume, arguments, paths, and destructive actions. Block tools entirely. Rate limit by minute, hour, or day. Cap cumulative spend. Restrict which paths a file tool can write to, which regions AWS can touch, which tables a database tool can modify. Require human approval for sensitive actions like high-value refunds, PR merges, or infrastructure changes. Start with deny-by-default and open up from there.
No. One line change in your MCP config. The agent sees the same tools and the same schemas. Nothing looks different until a limit is hit -- then the call is blocked and logged.
Prompts tell the agent what it should do. Intercept defines what it is allowed to do. A prompt is a best-effort instruction. A policy is a hard limit. You can't cap spend with a prompt. You can't make a tool genuinely read-only with a prompt. With Intercept, either the call is within policy or it isn't. No probability involved.
Add action: require_approval to any rule. When the agent triggers it, the call is held and the agent is told to wait. A human approves or denies via the CLI (intercept approvals approve <id>) or a local HTTP API. After approval, the agent retries and the call goes through exactly once. Different arguments require a new approval.
See your exposed tools, generate a policy, and enforce hard limits in minutes. Open source.
npx -y @policylayer/intercept