MCP Tool Governance

Every tool call. Governed before execution.

Your agents call databases, APIs, and file systems through MCP. Without governance, every call is an unaudited action on production data. Prüfer inspects them all — allow, block, escalate.

🤖

MCP Client

Claude, GPT, Gemini

Tool Call Request

Via Model Context Protocol

🛡️

Prüfer Gateway

Policy & Context Scan

Allowed
Blocked
Escalated
🔧

MCP Server

Tool Execution

MCP connects everything. Who governs the connections?

MCP gives your agents access to databases, internal APIs, file systems, and third-party services. Every tool call is a real action on real data — a database write, a file delete, an API call to a payment processor. Without governance, a single misconfigured agent can exfiltrate customer records or trigger unauthorized transactions.

Ungoverned MCP
Prüfer-Governed MCP
Agent calls database.delete on production table
Rule blocks destructive operations, escalates to human
Tool returns PII in raw response
Context Scanner redacts SSN/CC before agent receives it
No record of which agent called which tool
Every tool call logged with agent ID, parameters, decision
Any agent can access any tool
Tool whitelists scoped per agent and per fleet

Three lines of code. Every tool call governed.

Step 01: Connect

Install the Wrapper

One wrapper governs all MCP tools automatically.

// Vercel AI SDK integration
const governed = pruferWrapTools(client, myTools, {
  agentId: 'my-agent'
});
Step 02: Define Policies

Action Patterns

Write rules matching on parameters and MCP namespaces.

# Block destructive ops
- pattern: "tool:database.delete"
  decision: block

# Escalate large transactions
- pattern: "tool:payment.*"
  decision: escalate
Step 03: Audit

Compliance Evidence

Export board-ready reports mapped to NIST & ISO.

🇪🇺EU AI Act Mapped
🔒SOC 2 Aligned

Governance for the full tool lifecycle.

🛡️

Tool-Call Policy Enforcement

Rules match on "tool:" action patterns with glob matching. Block, allow, escalate, or audit any tool call based on name, parameters, or agent identity.

🎯

Parameter-Level Conditions

Write conditions directly against tool arguments — e.g. arguments.amount > 10000. 14 condition operators including regex and frequency-based velocity checks.

🔍

Context Scanning

Every tool payload is scanned for PII (SSN, credit cards), credentials, prompt injection, and exfiltration URLs. Blocks occur before the tool executes.

🔒

Agent-Scoped Tool Access

Assign which tools each agent can access. Agent A can call database.read but not database.delete. Per-agent, per-fleet isolation.

🔗

Delegation Chain Tracking

When Agent A delegates to Agent B via MCP, the full provenance chain is recorded — who triggered whom, with what parameters, at what depth.

Velocity & Frequency Rules

Detect anomalous tool usage. If an agent calls database.export 50 times in 5 minutes, trigger an automatic escalation.

Protocol-agnostic. Framework-native.

Prüfer doesn't care if the tool call comes from function calling, MCP, or a custom SDK. The enforcement engine sees action + context — the governance is the same. Native integrations handle the wiring.

Kong AI GatewayModel Context Protocol (MCP)Vercel AI SDKOpenAI AssistantsLangChainCrewAIAutoGen

Your agents are calling tools right now. Do you know which ones?

Start free — no credit card required. Govern your first tool call in under 5 minutes.