SECURE · MCP GOVERNANCE
Govern every MCP tool call before it executes
Tool-poisoning defense at discovery, drift detection, and a signed record of every call - with no proxy in your data path.
tools/list
Scanned at discovery
0 proxies
In your data path
Same chain
As LLM calls and agents
1 line
To turn it on
The problem
The risk is not what the model says, it is what the tool does
Tool poisoning
A malicious MCP server can hide instructions inside tool descriptions, which the model reads before any tool is ever invoked.
Description drift
MCP servers are third party, and a tool that was clean at review time can change under you without anyone noticing.
Blocking without proof
A gateway can block a tool call, but it cannot hand your auditor a signed record that the control was active and working.
The surface
A single agent run may touch all of these
Google Docs
Salesforce
GitHub
Slack
Databases
Internal APIs
How it works
From discovery to evidence, in four steps
01
Scan at discovery
Every tool description is checked at tools/list for instruction overrides, hidden directives, and exfiltration patterns.
02
Enforce per call
Allowlists, denylists, and policy run before each tool executes, client side.
03
Sign every event
Each tool call, allowed or blocked, is HMAC-signed into the same chain as your LLM calls.
04
Export the evidence
The MCP tool inventory ships inside the same one-click auditor evidence pack.
Capabilities
Client-side governance for the whole protocol
Poisoning defense at tools/list
Flagged tools raise a signed policy_flag event preserving exactly what the model was shown, and blockPoisonedTools strips them before the model sees them.
deterministic patterns · blockPoisonedTools
Drift detection
The exact tool surface is recorded at every discovery and diffed against the last one, and a clean tool turning poisoned raises a high-severity incident.
per-discovery snapshot · diff · incident on flip
No proxy, no routing change
Governance runs client side through a non-mutating construct-trap proxy, so no traffic leaves your environment through a third party.
construct trap · no monkey-patching
Enforcement plus proof
Every MCP tool call is signed into the same tamper-evident chain, so enforcement is also evidence.
HMAC chain · server countersigned
One evidence pack
MCP tool logs, LLM call logs, and agent traces land in one signed chain with one export for your auditor.
mcp-tool-inventory.json in the pack
One line to enable
Call obsvr.init() and every MCP tool call is intercepted, enforced, and signed, with no proxy and no additional config.
obsvr.init() · works with the MCP SDK