Secure your MCP servers

MCP guard is Intertrace's enforcement layer for Model Context Protocol traffic. When you route MCP through Intertrace, the Go enforcer sidecar evaluates every tool call against your org policy before it reaches the upstream MCP server. In enforce mode, a denied call short-circuits with HTTP 403 — no bytes leave Intertrace toward the upstream. In monitor mode, the same call is allowed through but flagged for review.

Policy state lives in Supabase (mcp_servers.trust_tier, mcp_servers.metadata.blocked_tools, mcp_tools.status and mcp_tools.approved_schema_hash) and is pulled into the enforcer via the agent-context endpoint with a ~5 s cache. The production edge is the Fly agentgateway at https://intertrace.fly.dev.

1. 1

   Route MCP through the Intertrace edge (Fly /mcp)

   This is the product path. Point MCP clients at https://intertrace.fly.dev/mcp with a runtime key and a server key. Cursor and Claude Desktop use a remote MCP entry in mcp.json. Full connect instructions and snippets: MCP servers and MCP console.

   {
     "mcpServers": {
       "intertrace-secured": {
         "url": "https://intertrace.fly.dev/mcp",
         "headers": {
           "Authorization": "Bearer itr_rt_YOUR_RUNTIME_KEY",
           "X-Intertrace-MCP-Server": "YOUR_SERVER_KEY"
         }
       }
     }
   }

2. 2

   Runtime SDK for agents

   If your agent already uses the Intertrace Runtime SDK (@intertrace-runtime/runtime on npm), wrap each tool with protectTool so authorize and an execution permit run before the tool body. Blocked (BLOCK) and approval-required (REQUIRE_APPROVAL) throw typed errors without running the executor. Enforce mode is fail-closed.

   This path is for agents that call tools in-process — not for MCP clients that speak the MCP wire protocol. If your agent talks to MCP servers over the wire, use path 1. SDKs.

3. 3

   stdio shim (legacy compatibility)

   For local MCP hosts that only launch a stdio process (older Claude Desktop or Cursor configs), the mcp-stdio shim bridges stdin/stdout to the wire proxy over HTTPS.

Intertrace classifies every MCP server into one of three trust tiers. Set the tier on each server row in Dashboard → MCP → Servers.

When you run Sync tools/list on a server, Intertrace pulls the upstream capability map into the mcp_tools table and computes a stable hash (sha256:canonical-json:v1) over each tool's name, description, and inputSchema.

Approve (or Approve all) pins approved_schema_hashfor each tool. On the next sync, if the upstream tool's hash changes, the status becomes drifted — a rug-pull or silent tool-swap signal.

Tool statuses: observed → approved → drifted / blocked / absent.

Two mechanisms, used together:

1. Per-server blocklist — add tool names to metadata.blocked_tools on the MCP server row. Set the trust tier to restricted so the blocklist is enforced.
2. Org rules — Dashboard → MCP → Rules. Maintain an org-level allowlist and blocklist. Start in Monitor (flag, never deny), then switch to Enforce when you are ready to block unknowns.

After connecting, send a tools/call that should be blocked (a tool in your blocklist, or a call to an untrusted server in enforce mode). The response should be HTTP 403. Check Events for the allow / flag / block outcome on Fly /mcp.