> ## Documentation Index
> Fetch the complete documentation index at: https://anthale.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Security Guide for AI Clients and Agents

> Secure Model Context Protocol integrations with server scoping, tool review, approval paths, and boundary-aware runtime controls in AI workflows.

Use this guide when your AI client or application connects to MCP servers for documentation, search, automation, or external systems. The protocol gives models a structured way to use tools, but the surrounding trust decisions still belong to you.

## Assumptions

* You control which MCP servers are available to each workflow or environment.
* You can review tool capabilities before a server becomes available in production.
* Anthale can evaluate content that enters or leaves the workflow around MCP tool use.

## Secure the integration

<Steps>
  <Step title="Inventory each server and its capabilities">
    Separate read-only lookup servers from servers that can change state, contact external systems, or expose sensitive
    data. Do not treat every MCP server as the same risk tier.
  </Step>

  <Step title="Treat descriptors and tool output as untrusted inputs">
    Server metadata, tool descriptions, and tool responses can all influence model behavior. Evaluate the next boundary
    before that content is trusted or reused.
  </Step>

  <Step title="Scope servers to the workflow that needs them">
    Give each workflow access only to the MCP servers and tools it needs. A read-only documentation assistant should not
    inherit the same server set as a workflow that can change production state.
  </Step>

  <Step title="Gate sensitive actions with validation and approval">
    If an MCP tool can send data, write records, run code, or trigger an external effect, keep allowlists, argument
    validation, and approval controls outside the model.
  </Step>

  <Step title="Log server, tool, and approval context">
    Record which server answered, which tool was proposed or called, what the approval decision was, and which policy
    governed the content path.
  </Step>

  <Step title="Review descriptor or capability changes">
    A server that was safe last week can become risky when its tool set or descriptions change. Treat those changes as a
    control review event, not as a routine prompt update.
  </Step>
</Steps>

<Tip>
  A read-only documentation server such as [Documentation MCP](/docs/build-with-ai/mcps/documentation-mcp) has a different
  risk profile from an MCP server that can send email, write tickets, or execute code. Keep those classes separate.
</Tip>

## What this looks like in code

<CodeGroup>
  ```python title="Python" theme={null}
  import json
  from os import environ

  from anthale import Anthale

  client = Anthale(api_key=environ["ANTHALE_API_KEY"])
  MCP_POLICY_ID = environ["ANTHALE_MCP_POLICY_ID"]

  ALLOWED_MCP_SERVERS = {
  "anthale-docs": {"search_anthale"},
  "ticketing": {"create_ticket"},
  }

  def guard_mcp_call(server_name: str, tool_name: str, approved: bool) -> None:
  if tool_name not in ALLOWED_MCP_SERVERS.get(server_name, set()):
  raise RuntimeError("This MCP tool is not allowed for the workflow.")

      if server_name == "ticketing" and tool_name == "create_ticket" and not approved:
          raise RuntimeError("Mutating MCP tools require approval.")

  def guard_mcp_tool_result(server_name: str, tool_name: str, tool_result: dict) -> dict:
  response = client.organizations.policies.enforce(
  policy_identifier=MCP_POLICY_ID,
  direction="input",
  messages=[{"role": "user", "content": json.dumps(tool_result)}],
  metadata={
  "boundary": "mcp_output",
  "feature": "support-agent",
  "serverName": server_name,
  "toolName": tool_name,
  "sourceType": "mcp",
  },
  )
  if response.action == "block":
  raise RuntimeError("Anthale blocked the MCP tool result.")

      safe_content = response.redacted_messages[0]["content"] if response.action == "redact" else json.dumps(tool_result)
      return json.loads(safe_content)

  ```

  ```text title="TypeScript" theme={null}
  import Anthale from "anthale"

  const client = new Anthale({ apiKey: process.env.ANTHALE_API_KEY })
  const MCP_POLICY_ID = process.env.ANTHALE_MCP_POLICY_ID!

  const ALLOWED_MCP_SERVERS = new Map<string, Set<string>>([
    ["anthale-docs", new Set(["search_anthale"])],
    ["ticketing", new Set(["create_ticket"])],
  ])

  export function guardMcpCall(serverName: string, toolName: string, approved: boolean): void {
    if (!ALLOWED_MCP_SERVERS.get(serverName)?.has(toolName)) {
      throw new Error("This MCP tool is not allowed for the workflow.")
    }

    if (serverName === "ticketing" && toolName === "create_ticket" && !approved) {
      throw new Error("Mutating MCP tools require approval.")
    }
  }

  export async function guardMcpToolResult(
    serverName: string,
    toolName: string,
    toolResult: Record<string, unknown>,
  ): Promise<Record<string, unknown>> {
    const response = await client.organizations.policies.enforce(MCP_POLICY_ID, {
      direction: "input",
      messages: [{ role: "user", content: JSON.stringify(toolResult) }],
      metadata: {
        boundary: "mcp_output",
        feature: "support-agent",
        serverName,
        toolName,
        sourceType: "mcp",
      },
    })

    if (response.action === "block") {
      throw new Error("Anthale blocked the MCP tool result.")
    }

    const safeContent = response.action === "redact" ? response.redacted_messages[0].content : JSON.stringify(toolResult)
    return JSON.parse(safeContent) as Record<string, unknown>
  }
  ```
</CodeGroup>

This keeps server and tool scoping in your application while Anthale evaluates the MCP content before it is trusted or
reused.

## Common failure patterns

* All MCP servers are exposed to every workflow by default.
* Tool descriptions are trusted as if they were developer-owned instructions.
* Sensitive MCP actions have no approval path because the client treats them as ordinary tool calls.
* Teams log the tool result but not the server identity or capability set that produced it.

## Apply this in Anthale

* [Create a first policy](/docs/quickstart/first-policy) when you want to test an MCP boundary with a working Anthale policy.
* [See the enforcement API](/docs/api-reference) when you need the exact contract for evaluating MCP content at runtime.
* [Request access](https://anthale.com/#request-access) when you want help reviewing a live MCP workflow.

## Related pages

* [Documentation MCP](/docs/build-with-ai/mcps/documentation-mcp)
* [Prompt Injection Hardening Skill](/docs/build-with-ai/agent-skills/prompt-injection-hardening)
* [Advanced Prompt Injection Paths](/docs/learn/guardrails/prompt-injection/advanced-attack-paths)

## Next steps

Continue with [Log Security Events](/docs/learn/secure-ai-systems/log-security-events) or [Gate Tool Actions](/docs/learn/secure-ai-systems/gate-tool-actions).