Skip to main content
Glama
Katalinhorvath-blip

Nura MCP Policy Interceptor

by Katalinhorvath-blip
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

Nura MCP Policy Interceptor

A lightweight, deterministic governance and policy enforcement gateway for Model Context Protocol (MCP) servers.

Install

npm install mcp-policy-interceptor

Requires Node.js 20 or later and @modelcontextprotocol/sdk 1.26 or later. npm installs the SDK peer automatically when it is not already present.

Protect an existing MCP tools/call handler in three lines:

import { createPolicyInterceptor } from "mcp-policy-interceptor";
const protect = await createPolicyInterceptor("./policy.yaml");
server.setRequestHandler(CallToolRequestSchema, protect(callToolHandler));

The wrapped handler runs only when the policy returns ALLOW. BLOCK and REQUIRE_APPROVAL requests return MCP errors without invoking application code. Pass a policy object, a PolicyEngine, or a path to a .json, .yaml, or .yml file.

Related MCP server: Aegis

Enterprise Governance & Pilot Program

mcp-policy-interceptor is architected as a deterministic, cross-language policy sidecar/proxy for Model Context Protocol (MCP) servers.

We are currently collaborating with engineering teams and enterprise architects to implement runtime write-path protection, asynchronous Human-in-the-Loop (HITL) approval webhooks, and immutable audit trails.

  • 📊 Take our 60-second survey: AI Agent Security Survey

  • 📬 Discuss an Enterprise Pilot: Open an issue or contact horvathkit@gmail.com

Features

  • Hard Guardrails: Instantly drop forbidden tool execution requests before hitting systems of record.

  • Dynamic Parameter Bounds: Intercept requests that exceed numerical thresholds (e.g., discounts, spend limits).

  • Human-in-the-Loop Hooks: Pause high-risk operations and surface human review requests.

  • Audit Telemetry: Cryptographic-ready logging for all agent-tool evaluations.

Demo CLI

npx mcp-policy-interceptor --policy ./policy.yaml

The demo CLI uses MCP stdio transport and is intended to be launched by an MCP client.

External Policy Files

Pass a JSON or YAML policy at startup to update rules without recompiling TypeScript:

node dist/cli.js --policy ./policy.json

# The npm equivalent passes arguments after --
npm start -- --policy ./policy.yaml

JSON example:

{
	"forbiddenTools": ["delete_database_record", "purge_crm_contacts"],
	"requireApprovalTools": ["issue_refund", "update_deal_stage"],
	"maxParamLimits": {
		"discountPercentage": 20,
		"amount": 1000
	}
}

YAML example:

forbiddenTools:
	- delete_database_record
	- purge_crm_contacts
requireApprovalTools:
	- issue_refund
	- update_deal_stage
maxParamLimits:
	discountPercentage: 20
	amount: 1000

Supported extensions are .json, .yaml, and .yml. Relative paths are resolved from the process working directory. Missing, malformed, or schema-invalid policy files stop startup with an error. If --policy is omitted, the built-in policy is used.

Development

npm install
npm test

Verification

npm test

The test command builds into dist/ and verifies:

  • Governance decisions use only ALLOW, BLOCK, and REQUIRE_APPROVAL.

  • Forbidden tools and out-of-bounds parameters return policy failures without invoking the target executor.

  • Every evaluated tool request emits a [GOVERNANCE AUDIT LOG] entry with its timestamp, decision, tool name, and reason.

  • The compiled stdio server enforces built-in and external policy behavior through an MCP client.

Available Tools

2 tools
apply_deal_discountB

Applies a percentage discount to an active deal.

ParametersJSON Schema
NameRequiredDescriptionDefault
dealIdYes
discountPercentageYes

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, but it only says 'Applies a percentage discount'. It fails to reveal side effects, reversibility, permission requirements, or the behavior when the deal is not active.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one sentence long, front-loaded with the action, and contains no filler or redundant information. Every word contributes to the purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the two-parameter tool, the description is minimally acceptable but lacks context around preconditions, effects, and return behavior. There are no annotations or output schema to compensate for these missing details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds the meaning that 'discountPercentage' is a percentage, which is a slight improvement over the bare schema. However, it does not explain valid ranges, the format of 'dealId', or preconditions like the deal needing to be active.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Applies' and clearly identifies the resource ('a percentage discount to an active deal'). It unambiguously distinguishes this tool from the sibling 'delete_database_record', which performs a different action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, nor does it mention prerequisites such as the deal needing to be active. It only restates the action without any contextual usage direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_database_recordB

Permanently purges a record from the database.

ParametersJSON Schema
NameRequiredDescriptionDefault
recordIdNo

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the destructive and irreversible nature via 'permanently purges', which is critical behavioral information. However, with no annotations available, it should have covered additional traits like error handling, side effects, or required authentication, but it does not.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that directly and efficiently states the tool's purpose. Every word earns its place, and there is no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is inadequate for a destructive operation. It does not clarify how the record is identified, what the required input is, or any safety precautions beyond 'permanently'. The unclear required parameters compound the gap, making the tool risky to invoke blindly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage and the description does not explain the recordId parameter. While the parameter name is fairly self-explanatory, the description adds no extra meaning, and the fact that required parameters are 0 is confusing and unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function with a specific verb ('purges') and resource ('record from the database'). It does not explicitly distinguish from the sibling tool apply_deal_discount, but the names make the distinction obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. There are no prerequisites, context, or exclusions mentioned. The description offers no usage direction beyond stating the action.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv1.0.0
    • First observedapply_deal_discount
    • First observeddelete_database_record
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.3/5.0

Scored across 2 tools

Disambiguation5/5

The two tools are entirely distinct: one applies a discount to a deal, the other deletes a database record. There is no overlap or ambiguity between their purposes.

Naming Consistency5/5

Both tools follow the verb_noun pattern with snake_case: 'apply_deal_discount' and 'delete_database_record'. This is consistent and predictable.

Tool Count3/5

With only 2 tools, the server feels thin for a 'Policy Interceptor' scope. The count is on the low end of borderline, as it may not cover enough operations to be truly useful.

Completeness2/5

The tool surface is sparse and lacks obvious lifecycle operations. For a policy interceptor, one would expect at least read/list functionality alongside the action tools, and the current set leaves significant gaps in typical CRUD or policy management workflows.

Resources

Related MCP Connectors

Related MCP Servers

  • mcpclerk

    hishamalward
    A
    license
    Not graded
    quality
    A
    maintenance
    Provides a governance proxy layer for MCP servers, enforcing per-tool allowlists, human approval for write operations, quotas, secret redaction, and a hash-chained audit log of all calls.
    MIT

  • Aegis

    nithyajangam
    F
    license
    Not graded
    quality
    B
    maintenance
    Enables governing tenant-aware MCP tools with policy enforcement, scoped access, human approval workflows, and tamper-evident audit logging.
    -

  • mcp-policy-gateway

    jcorrego
    A
    license
    A
    quality
    C
    maintenance
    Enables policy-governed MCP interactions with deterministic authorization, tenant isolation, minimized PII exposure, and human approval gates for sensitive mutations, while producing structured audit events.
    3
    MIT

  • MCP Policy Gateway

    ahmed0qaid
    A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents and MCP clients to safely access upstream MCP servers through centralized policy enforcement, including allow/deny/approval decisions, schema pinning, circuit breakers, and audit logging.
    MIT