12 posts
Anthropic published the production playbook for MCP: 300M SDK downloads, thin tools over 2,500 endpoints, OAuth vaults. The playbook stops at the tool call. Argument-level policy is what comes next.
Cloudflare's enterprise MCP launch solves discovery, access, and shadow-MCP prevention. That's the baseline. The harder question — what agents are allowed to do once they're inside — needs a different primitive.
Microsoft open-sourced a nine-package agent governance toolkit. It validates the space — but it doesn't address MCP. Here's what that means for teams running MCP agents in production.
MCP policy enforcement intercepts every AI agent tool call and evaluates it against deterministic rules before execution. Here's how it works and how to set it up.
System prompts can't enforce spending limits or prevent destructive operations. Here's why prompt guardrails fail for tool-calling AI agents and what works instead.
Bain & Company's agentic AI architecture framework calls for centralised policy enforcement across MCP tool calls. Intercept is the open-source implementation.
Most teams will wrap their own dangerous tools. The real market for agent control only gets large if agents become dynamic consumers of external services the team did not fully pre-wrap.
Security researchers filed 30+ CVEs against MCP servers in early 2026. Patching individual servers doesn't fix the structural gap. The real fix is a policy layer that works across all of them.
A new research paper argues that LLMs cannot self-enforce security constraints. Intercept implements every recommendation — as open-source software you can deploy today.
LLMs can't reliably self-enforce safety rules. Deterministic policy enforcement outside the model catches what prompts miss — here's the architecture.
What happens when your AI agent goes rogue? Six failure modes — runaway loops, spending spirals, destructive ops — and the deterministic policies that stop them.
Prompt guardrails for MCP agents are bypassable and unauditable. Why deterministic policy enforcement at the transport layer is the real security primitive.