Policies · Approvals · Audit record

MCP Governance: decide exactly what your agents may do

AI governance for the tools your agents call over MCP: a default policy, your exceptions, and a verdict on each call before it reaches a server.

Try for free Quick tour video

A unified platform for every AI interaction

Your agents keep interacting with a single endpoint, calling same tools.

  1. You write the policy

    Stripe is allowed. Refunds over $300 need approval.

  2. Every call meets the policy

    Meandr checks it against your policy before it leaves.

  3. The policy holds it for approval

    A $500 refund stops. Say no and it never reaches Stripe.

  4. Every call in the audit log

    Who called, what they asked for, which policy decided.

  5. One gateway, every agent and server

    Agents, servers, policies and traffic in one gateway.

How it works

MCP policy enforcement: your rules, in the order they're checked

Each workspace keeps one ordered list of policies, and the first policy that matches a call gives the verdict.

  1. 01 Default policy

    Every workspace starts with a default policy, and you add exceptions to it

    In MCP Governance, the default policy answers any call no other policy matches. It starts as Deny, so a new agent sees no tools until you allow something.

    • An exception is a policy with a priority number: lower numbers are checked first, the default policy last
    • A policy switched off is skipped until you switch it back on
    • The default policy can't be deleted, but you can change its action (Allow or Deny) and its Record responses switch
    Guide: write your first policy

  2. 02 Access control

    MCP access control: which agents, servers and tools a policy covers

    MCP access control is set on each policy. Targets name agents, servers, tools, prompts and resource templates, and an agent tag covers every agent that carries it. An empty list covers everything, so a policy linked only to a server also covers tools you import from that server later.

  3. 03 Request conditions

    Request conditions narrow a policy to the calls that meet them

    Conditions are optional, and a call must pass all of them. They can check the name of the tool or server, the file or record the call asks for, tool hints (read-only, destructive, idempotent, open world), the caller's IP address range, request headers and the values the agent sends, such as an amount above a set limit.

    • A name pattern has to match the whole tool name, not just a part of it
    • A hint the server never declared matches no condition
    • Argument conditions are judged per call, so the tool stays in the agent's list
    Argument-level policy vs allowlists

  4. 04 Verdict

    Allow runs the call, Deny stops it, and Approve holds it until a person decides

    Approvers seated on the policy get a notice in the console and by email and decide on the Tasks page or, with Interactive approval, in the agent's chat. A denied or expired call never runs.

    • Approval type Offline or Interactive, with a deadline in seconds
    • Require an OTP (Interactive only): each approver gets a single-use code, and the approval is recorded under their name. Without it, anyone in the agent's session can answer, unnamed
    • The first valid code decides and voids the rest; a wrong code ends the request
    • A full approval queue denies new requests until it drains
    Human approvals in practice Step by step: MCP human approval

  5. 05 Audit record

    Meandr writes each verdict into the call's audit record

    The record keeps the deciding policy, its action and its reason code.

    MCP audit logs: trace what an agent did

Questions about MCP Governance

Can a policy rely on a tool's read-only or destructive hint?
Only as a hint: the server declares it, and Meandr doesn't verify it. Where a wrong label would hurt, use the Approve action.
Do policies cover prompts and resource templates too?
Yes. Prompt and resource-template lists are filtered by policy the way tool lists are, and argument conditions also apply when an agent requests a prompt.
What is the difference between Offline and Interactive approval?
Offline works with every MCP client: the agent is told the call is waiting for approval and can check back for the result, while approvers decide on the Tasks page. Interactive shows an approval form inside the agent's chat, and if the client can't display a form, the request switches to Offline.
How does the agent learn what the approver decided?
Meandr adds a status tool to every agent's tool list. The agent calls it with the held call's ID to see whether the call is still waiting, was denied, or ran, and gets the result once the call has run.

Check each agent's tool calls against your policies before they run

A new workspace comes with its default policy, so the first call already gets a verdict.

Try for free

Questions? Email us