MCP Governance

Decide exactly what your agents may do.

AI governance for the tools your agents call over MCP: write rules that read the real call — down to the argument values. Auto-allow the safe stuff, ask a human before anything risky, and keep a full record of every decision: who, what, and which rule made the call.

Get started See how it works

Your rules, in the order they're checked.

Each rule reads the real call — down to the argument values — and runs in priority order. The first one that matches decides what happens next.

Policy rules — screenshot placeholder
Rules in priority order — the first match wins.

Allow or deny a whole tool is too blunt.

The calls that matter live in the details — the amount, the target, the operation — not in the tool's name.

One tool, a hundred meanings

A single "write" tool can mean "update a note" or "delete an account," depending on the arguments. "Allow this tool" quietly allows all of it.

No graceful "ask first"

Sometimes you just want a human to nod before a big or irreversible action. Doing that without breaking the agent's flow — or losing the context of what it's asking — is hard on your own.

No proof after the fact

When it matters, "it was allowed" isn't enough. You need who decided, on which rule, and — sometimes — exactly what was sent and returned.

How it works

Rules, a human when needed, and a record.

Every call runs through your rules on the way to the tool. Most sail through; the ones you've flagged wait for a person. All of them are written down.

01

Rules

First match wins.

Your rules run in order and each call gets one of three answers: allow, block, or ask a human. Rules can match on the agent, the server or tool, and the actual argument values — "any refund over $100," "anything that starts with delete."

You set up: the rules, in the order you want them checked.

02

Approve

A quick yes or no.

When a rule says "ask a human," the call pauses and a person is notified. Depending on the client, they can decide right inside the agent's chat or from a review screen. Approve and it runs as asked; deny (or let it time out) and it never does.

You set up: which actions need approval, and who can give it.

03

Record

Every call, written down.

Allowed, blocked, or held — each call becomes an audit record: who, what, when, and which rule decided. Need the full request and response too? Turn on encrypted capture for that rule. It's off unless you ask.

You set up: what to keep, and where capture is turned on.

Approval prompt — screenshot placeholder
A human sees exactly what's being asked — then approves or denies.

Control that fits the call, not just the tool.

Fine-grained where it counts, hands-off where it doesn't — with a record either way.

Rules down to the argument

Match on the actual values in a call, not just which tool was used. "Refunds under $100: allow. Over $100: ask a human." — the only real way to govern catch-all tools.

A human, without the friction

Hold the risky calls for a quick yes/no — for supported clients, right inside the agent's own chat. The agent waits; you decide; it carries on. No separate tool to babysit.

A record for every decision

Not just "allowed" — who or which rule decided, on what, and when. When someone asks what happened, the answer is one search away.

Capture only what you choose

By default Meandr records that a call happened and what decided it — not the contents. Want the full request and response kept, encrypted? Turn it on per rule. Off everywhere else.

Sensible starting rules

When a server declares a tool as read-only or destructive, Meandr can factor that into your rules — so you start from a sensible default instead of a blank page.

On from day one

There's always a policy in force — even before you write your first custom rule. Governance isn't a setting you might forget to switch on.

Questions you'd ask anyway.

Can I require approval only above a certain amount, not for the whole tool?
Yes. Rules can match on the arguments of the call itself — an amount over a threshold, a specific operation — not just which tool was used.
Do you store the content of every call by default?
No. By default Meandr records only the metadata — who, what, when, which rule decided — not the actual request or response. Full capture is opt-in, per rule, and stored encrypted when you turn it on.
Where does a human approve or deny?
From a review screen, and — for agent clients that support it — as a prompt right inside the agent's own conversation, confirmed with a one-time code so the approval comes from a person you authorised. You choose which experience to offer.
What happens to a denied or expired request?
The call never runs — nothing reaches the tool server. The decision is recorded either way.
Can a rule rely on a tool being "read-only" or "destructive"?
Yes, when the server declares it — Meandr can fold that into your rules. But it's a self-declared hint from the server, not something Meandr independently verifies, so treat it as a useful default rather than a guarantee.

Say exactly what your agents may do — and prove what they did.

Point your agent at one endpoint and you're governed in minutes — no code changes, no proxy to run.

Get started

Questions? Email us