Policy Schema Reference

MakeYourMCP gateways enforce security policies that allow or deny MCP tool calls based on tool name. Policies use glob patterns (fnmatch) for flexible matching. Define your policy as JSON and apply it to any agent in the dashboard.

Top-Level Structure

A policy is a JSON object with the following fields:

• name: Human-readable policy name (e.g., "read-only-analyst").
• default_action: What to do when no rule matches — "allow" or "deny". We recommend "deny" (explicit allowlist).
• rules: An object containing allow and deny arrays of glob patterns.

Rule Matching

• allow array: List of glob patterns (fnmatch) for tools the agent may call. Example: "read_*", "query_*".
• deny array: List of glob patterns for tools the agent must not call. Example: "delete_*", "drop_*".
• Pattern matching: Uses fnmatch semantics. "read_*" matches "read_file", "read_table", etc. "*_admin" matches any tool ending in "_admin".
• Deny precedence: If a tool name matches both an allow pattern and a deny pattern, deny always wins.
• Default action: If a tool name matches neither allow nor deny patterns, the default_action is applied.

Complete Schema Example

{
  "name": "read-only-analyst",
  "default_action": "deny",
  "rules": {
    "allow": [
      "read_*",
      "list_*",
      "get_*",
      "query_*"
    ],
    "deny": [
      "delete_*",
      "drop_*",
      "write_*",
      "update_*"
    ]
  }
}

Policy Evaluation Logic

When an agent calls a tool, MakeYourMCP evaluates the policy as follows:

1. Check if the tool name matches any pattern in the deny array. If yes, block the call.
2. Check if the tool name matches any pattern in the allow array. If yes, allow the call.
3. If no patterns match, apply the default_action (allow or deny).

Deny always wins: If a tool name matches both an allow and a deny pattern, the deny rule takes precedence. This lets you write broad allow rules and then add specific deny blocks.

Common Pitfalls

• Forgetting to set default_action to "deny": If default_action is "allow", any tool not explicitly listed in deny will be allowed. Always start with "deny" and explicitly allow only safe tools.
• Over-broad wildcards in allow: A pattern like "*" in the allow array allows all tools. Be more specific: use "read_*", "list_*" instead.
• Forgetting to deny destructive operations: Even if your data source has read-only credentials, explicitly deny "delete_*", "drop_*", "write_*" in the policy for defense-in-depth.

Integration Guides

• Secure Claude Desktop MCP Server — Prompt Injection Protection — configure Claude Desktop to route through the gateway
• Secure PostgreSQL MCP Server — RBAC & Query Filtering — apply policies to PostgreSQL tool calls
• Full Documentation Index

Roadmap (Not Yet Available)

The following policy features are on the MakeYourMCP roadmap but are not yet enforced:

• Role-based rules: Match policies to specific agent roles.
• Resource scoping: Restrict access by connector, schema, or table.
• Runtime constraints: Row limits, column masking, IP allowlists, time windows.
• Human-in-the-loop approvals: Require manual approval for sensitive operations.

Today, policies are name-based (tool names) and global (applied to all agents using the policy). These features will be available in future releases.

← Back to documentation index