Why it matters
MCP connected your agents to everything — including the attacker
The Model Context Protocol makes it trivial to give an AI agent tools, files, and data. But an MCP server is code you didn't write, running with your agent's authority, describing its own tools in free text your agent will read and act on. In 2025–2026 that became one of the most rapidly weaponized surfaces in agentic AI — remote-code-execution CVEs, config-swap exploits, and tool-poisoning that hides instructions in what looks like help text.
How it works
Authorize every call, before it runs
Route MCP through Intertrace and the Go enforcer evaluates every tools/call against your org policy before it reaches the upstream server.
Pre-action authorization
Every tools/call is checked against policy — the tool, the arguments, the tenant — at decision time. An allowed call gets a scoped execution permit; a disallowed one never runs.
Tool-description inspection
Descriptions and schemas are scanned for embedded instructions and hidden characters before the agent is allowed to use a tool — so a poisoned or compromised server can't smuggle commands through its own help text.
Fail closed
In enforce mode a denied call short-circuits with HTTP 403 — no bytes leave Intertrace toward the upstream. If the enforcer can't decide, it denies rather than passing traffic through.
Monitor or enforce
Start in monitor mode — the same calls are allowed through but flagged for review — then flip to enforce when you're confident. Nothing about your agents changes; the policy just starts biting.
Trust tiers
Classify MCP servers by how much you trust them and apply proportionate policy — tighter controls and narrower tool access for the servers you know least about.
Schema pinning & drift
Pin a server's tool schemas and detect drift — if a tool you approved last week quietly becomes something else this week, MCP Guard catches the change instead of trusting it.
Getting started
Three ways to connect
Put Intertrace in the path however your agents reach MCP — no rewrite required.
Intertrace edge
Point your MCP client at the Fly /mcp proxy. Intertrace terminates, authorizes every call, mints execution permits for allowed calls, and forwards only what passes.
Runtime SDK
Wrap your agent's MCP calls with the Intertrace runtime so authorization and evidence happen inline, inside your deployment boundary.
stdio shim
A drop-in shim for local/legacy MCP clients that speak stdio — same authorization and inspection, no network change.
What we claim
Inspected, pinned, and fail-closed — not magic
MCP Guard doesn't make MCP safe in the absolute. It makes MCP inspected, pinned, tenant-bound, and fail-closed, with a record of every refusal — so a compromised server becomes a logged, denied event instead of a silent breach. That maps directly onto the failure modes the year's incidents exercised: tool poisoning is caught at inspection, silent swaps at pinning, and injected results are constrained at authorization.