MCP control

MCP tool allowlists for IDE coding agents (Claude Code, Cursor, Codex, OpenCode). Decide which MCP tools and actions agents may call. Draft a PR—yes. Hit prod APIs or secret stores—not without a hard deny (or a real ask UX on Claude).

Part of Control with bash, path, and prompt. Session patterns: Behavior Guards.

Why it matters

MCP expands what an IDE agent can reach—GitHub, cloud, secret stores, internal HTTP. Without org-wide allowlists, each laptop’s MCP config becomes an ungoverned integration surface.

How it works

When an agent selects an MCP tool, Relay evaluates mcp rules before the tool runs.

Denied calls return a structured reason and land in audit. Console Rulebook can suggest Seen in your org MCP server/tool ids from sessions (suggest-only).

For platform MCP used by DevX Assist Copilot and Marshal gateway tools, see Tools & MCP and AI Gateway—this page is the IDE coding-agent channel.

Real-world examples

GitHub draft workflow, not production apply

Scene: “Open a draft PR for this branch.” The agent calls GitHub MCP: create PR, list checks, comment.

Policy: Allow glob/exact for read + draft tools (github.*pull*, github.*list*, or your server’s tool ids). Deny *.merge, deploy, or delete-repo style tools.

Outcome: Agents stay in the PR loop; merge/deploy requires a human outside the agent (or a separate allow for release engineers).

Secret-store and prod MCP never auto-run

Scene: “Rotate the staging DB password” or “apply this manifest to prod.” The agent targets secrets.*, vault.*, kube.apply, or unrestricted HTTP MCP.

Policy: Deny those server/tool ids (or entire servers). On Cursor, do not rely on Soft ask—deny. On Claude, Soft ask can pause for confirmation if you want a human in the loop.

Outcome: Live wire records the blocked MCP call; credentials and prod mutators do not fire from a chat prompt.

Also common

• Broad * allowlists: Convenient for demos, dangerous in shared orgs—prefer server-scoped globs (jira.*, linear.*) and explicit deny for admin tools.
• Admin-ish names: Tools with admin, iam, secrets, delete_ also feed Privilege Streak even when a single call is allowed.
• Polling MCP: Identical payments.get_status args are Retry Thrash; MCP rules still decide whether that tool is allowed at all.

Allow and deny starters

Allow (examples)

• GitHub / GitLab read + draft PR tools
• Issue tracker read (jira.*, linear.*—adjust to your MCP ids)
• Internal catalog lookup MCP

Deny (examples)

• secrets.*, vault.*, iam.*
• kube.apply, terraform.apply, unrestricted HTTP proxies
• Destructive delete tools on shared servers

Author in Relay → Rulebook with resource_kind=mcp. Matching badge: exact or glob.