Security controls

At sync the gateway records the exact definition of every capability, description included: rewriting a description is all a poisoning attack needs. A call is allowed only when the tool is known, switched on for the connector and the endpoint, and unchanged since it was approved. Unknown means refused. Tool lists go further: a tool is shown to an agent only when the definition the server is serving at that moment is the approved one, so a description rewritten between syncs never reaches the model.

Every new or changed definition is scanned at sync: names, titles, descriptions, annotations and every argument description, value list and default. It looks for the published poisoning patterns: hidden tags such as <IMPORTANT>, instructions to read sensitive files, to send data to an address, to keep something from the user, or to change how other tools behave. A flagged definition is quarantined: hidden from lists and refused, with the findings shown on the Capabilities tab, until an admin releases that exact definition. A later change is scanned again.

An MCP key can be limited to some tools: <endpoint>/<tool>, or <endpoint>/* for all of one endpoint’s tools. It can only narrow what the endpoint allows. Tools outside it are hidden from the key and refused, including through discover and run.

Two kinds run on tool calls, prompt requests and resource reads: on the arguments before anything is sent, and on the result before the agent sees it. Each text field is checked on its own, so a redaction keeps the rest intact.

• The built-in scan, with nothing to set up: arguments for secrets; results for injected instructions and secrets; resources also for personal data. It records what it finds (the call’s drawer in Logs shows it) and does not block.
• Your guardrails, attached on a connector (every endpoint of it) and on an endpoint (added to the connector’s). They act as configured: BLOCK, REDACT or MONITOR. One that cannot run fails the call closed. A blocked argument means the tool is never called; a blocked result is withheld; a redacted one is what the agent gets and what is stored. See Guardrails.

Guardrails bound to a virtual key apply to LLM requests only, not to tool calls.

The gateway cannot see an agent’s context, but it knows what it handed the agent. Every result is treated as untrusted (someone outside could have written it), unless its capability is marked Trusted output. After receiving untrusted content, the caller (the MCP key, or the person) counts as having it in context for 30 minutes, across the whole organization: an agent reads with one tool and writes with another.

During that time a tool marked Privileged is refused, naming the call that brought the content in, unless a person approves the call. If the gateway cannot tell whether the caller has received untrusted content, it refuses. Results carry a hint saying until when the caller counts as having untrusted content (see hints).

A tool marked Needs approval is held on every call, and a Privileged tool is held when the caller has untrusted content. A held call is refused with a link to the Approvals page, where it shows the caller, the tool, why it was held and its exact arguments.

1. A person approves or rejects it within 24 hours. Only a signed-in person decides, never a key: a workspace admin, or the person whose own call it was.
2. The agent makes the same call again (same caller, endpoint, tool and arguments) within 15 minutes of the approval. It goes ahead once.
3. Nothing runs from the Approvals page itself, and a retry while the request is still waiting points at the same request rather than queuing another.

While answering a call, an MCP server can ask the client for things. Each endpoint decides on its Server requests tab, and every request is logged as its own row under the call.

• Who may use an endpoint. On its User access tab: allow or deny by default, and per person. Applies to people signing in, not to keys. A denial is recorded like any refusal.
• Connections. The endpoint’s Connections tab lists the MCP clients people approved, and revokes them. People see and revoke their own on their profile.
• Rate limits. Each key can have calls per minute and per day, and the plan sets a limit per workspace. These counters are separate from LLM traffic. Over a limit, the answer is HTTP 429 with Retry-After.

Every refusal names its control, in the tool result’s _meta["ai.vectoraxis/gateway"].control, in the JSON-RPC error’s data.control, or in egress mode’s X-VectorAxis-Gateway header, and in Logs.