Guardrails

MCP governance

What it is

Policy for agent tool calls

MCP (Model Context Protocol) lets an agent call external tools — read a repo, query a database, send a message. That power needs governance. Anoman lets you register an MCP server, automatically discover the tools it exposes, and set a policy for each tool. The gateway then enforces that policy on every tool call routed through it, before the model or provider is invoked.

Enforced pre-call. A denied tool call is blocked with HTTP 403 before it ever reaches the LLM or the tool itself — the model never gets the chance to invoke a forbidden action.

Register a server, discover its tools

Registering a server discovers its tool catalog for you: Anoman calls the server's tools/list method and records every exposed tool so you can set policy on each. New tools default to allow; tighten the ones that matter. Use evaluate to dry-run a decision without side effects.

Server & tool management is dashboard-only. In v1, registering servers and setting tool policy is done in the Anoman dashboard or Copilot by an account admin — the API shapes below are shown for reference, and raw anm-sk- keys are rejected for these management calls. Runtime governance on your own completion calls is unchanged: keep sending your anm-sk- key to the gateway and every tool call is enforced against your policy.

# Register an MCP server + auto-discover its tools via tools/list.
# Server & tool management is an account-admin action done in the Anoman
# dashboard or Copilot — raw anm-sk- API keys are rejected for management.
# API shape shown for reference:
POST https://api.anoman.io/anoman/v1/mcp/servers
{
  "name": "github-tools",
  "endpoint_url": "https://mcp.example.com/github",
  "transport": "http"
}

Policy modes

allow / deny / require_approval

Each tool carries a policy_mode, one of three values. Newly discovered tools default to allow so registering a server never breaks a working agent — you opt IN to restriction.

policy_mode	Behavior
allowDefault	The tool call proceeds normally. This is the default for newly discovered tools.
deny	The tool call is blocked with HTTP 403 before the model or provider is invoked.
require_approval	The tool call requires explicit approval before it can run — use this for high-blast-radius actions (deletes, writes, spend).

Denied calls are blocked before the LLM/provider call — the gateway returns 403 and the agent gets a clean refusal instead of executing the action.

Scopes, rate limits, audit

Fine-grained control per tool

OAuth2 scopes — attach required_scopes to a tool so it only runs when the caller presents the right OAuth2 scope.
Rate limits — set rate_limit_per_min per tool (enforced in Redis) to cap how often an agent can call an expensive or destructive tool.
Audit log — every tool invocation is recorded. Query the history via GET /anoman/v1/mcp/invocations, filterable by status, for a full audit trail of what your agents did.

Endpoints

The /anoman/v1/mcp API

Endpoint	Purpose
POST/anoman/v1/mcp/servers	Register an MCP server and discover its tools via tools/list.
GET/anoman/v1/mcp/servers	List the MCP servers registered for your account.
DELETE/anoman/v1/mcp/servers/{id}	Deactivate a registered server.
GET/anoman/v1/mcp/servers/{id}/tools	List the tools a server exposes, with their current policy.
PATCH/anoman/v1/mcp/tools/{tool_id}	Update a tool's policy_mode, required_scopes, or rate_limit_per_min.
GET/anoman/v1/mcp/invocations	Audit log of tool invocations, filterable by status.
POST/anoman/v1/mcp/evaluate	Dry-run a tool call against your policy (dashboard preview, no side effects).

Manage all of this visually at /dashboard/mcp in the dashboard. MCP policy is part of your policy group configuration, alongside the guardrail modes.

Govern your agent's tools

Open MCP governance Guardrails overview