SECURE · MCP GOVERNANCE
Govern supported MCP tool calls before it executes
Govern documented MCP discovery and tool calls before execution.
tools/list
Scanned at discovery
0 network hops
For client-side policy
Same chain
As LLM calls and agents
1 wrapper
At the MCP client boundary
The problem
The risk is not what the model says, it is what the tool does
Tool poisoning
A malicious MCP server can hide instructions inside tool descriptions, which the model reads before any tool is ever invoked.
Description drift
MCP servers are third party, and a tool that was clean at review time can change under you without anyone noticing.
Blocking without proof
The governed MCP client produces a signed decision record alongside enforcement without conflating blocking with evidence.
The surface
A single agent run may touch all of these
Google Docs
Salesforce
GitHub
Slack
Databases
Internal APIs
How it works
From discovery to evidence, in four steps
01
Scan at discovery
Tool descriptions returned through a governed tools/list route are checked for instruction overrides, hidden directives, and exfiltration patterns.
02
Enforce per call
Allowlists, denylists, and policy run before each tool executes, client side.
03
Sign emitted tool evidence
Supported governed tool routes emit allowed or blocked records into the same HMAC chain as model calls.
04
Export the evidence
Governed discovery records preserve the point-in-time tool inventory for review and inclusion in the generated evidence pack.
Capabilities
Client-side governance for documented MCP routes
Poisoning defense at tools/list
Flagged tools raise a signed policy_flag event preserving exactly what the model was shown, and blockPoisonedTools strips them before the model sees them.
Drift detection
The exact tool surface is recorded at every discovery and diffed against the last one, and a clean tool turning poisoned raises a high-severity incident.
No network proxy or routing change
Governance runs through a client-side JavaScript Proxy that avoids prototype patching and closes cached-access bypasses.
Enforcement plus proof
Emitted decisions from supported governed MCP routes join the same tamper-evident chain, so enforcement also creates evidence.
One evidence pack
Emitted MCP tool records, model-call records, and agent traces can share one signed chain and evidence export.
Wrap the MCP client boundary
Use obsvrGovernMCP in TypeScript or govern_mcp in Python, then ensure the application uses the governed client reference for supported discovery and tool routes.