MCP Policy — per-App · per-Axis · per-Tool¶

MCP enforcement is configured at three levels of granularity, all from G-1 Studio. Platform-wide settings (ports, modalities) live in Settings → MCP; everything that decides what gets blocked is per Application, under Applications → app → MCP.

Because policy is per Application, scoring uses that Application's bound model, so the per-model SLEDGE/axis calibration applies to MCP exactly as it does to chat.

Set it¶

MCP enforcement is part of the Application config, under mcp. Read it, patch it, and it applies to every tool surface that Application sees.

curl -s -X PUT http://localhost:8080/v1/glad/apps/support_bot \
  -H "Content-Type: application/json" \
  -d '{"config":{"mcp":{
        "enabled": true,
        "action_tool_description": "block",
        "action_tool_args": "policy",
        "action_tool_result": "annotate",
        "domain_allowlist": ["intranet.acme.com"],
        "tools": {
          "read_file":  {"trusted": true},
          "send_email": {"egress": true, "action": "block"}
        }}}}' | jq '.config_version'

import httpx

c = httpx.Client(base_url="http://localhost:8080", timeout=30)

app = c.get("/v1/glad/apps/support_bot").json()
mcp = app["config"].get("mcp", {})
mcp |= {
    "enabled": True,
    "action_tool_description": "block",     # block | annotate | off
    "action_tool_args": "policy",           # + "policy" (the deterministic intent policy)
    "action_tool_result": "annotate",
    "axis_actions": {"jailbreak": "block"}, # per-axis override of the surface action
    "domain_allowlist": ["intranet.acme.com"],
    "tools": {
        "read_file":  {"trusted": True},                      # skip scanning
        "send_email": {"egress": True, "action": "block"},    # treat as a data sink
    },
}
c.put("/v1/glad/apps/support_bot", json={"config": {"mcp": mcp}})

await fetch("http://localhost:8080/v1/glad/apps/support_bot", {
  method: "PUT",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ config: { mcp: {
    enabled: true,
    action_tool_description: "block",
    action_tool_args: "policy",
    action_tool_result: "annotate",
    domain_allowlist: ["intranet.acme.com"],
    tools: { read_file: { trusted: true }, send_email: { egress: true, action: "block" } },
  } } }),
})

Per-surface actions are flat fields (action_tool_description, action_tool_result, action_tool_args), not a nested object. action_tool_args additionally accepts policy — the deterministic intent policy — alongside block / annotate / off.

Read the live layer state — which servers and interceptors are listening, and the actions in force — with GET /gw/v1/glad/mcp/status.

1 · Per Application¶

2 · Per Axis¶

Override the action and threshold for each of the six detection axes within MCP scans. The table in the MCP tab has one row per axis:

3 · Per Tool¶

Add rules keyed by tool name. Per-tool always wins over per-axis and surface policy.

The exfiltration intent policy¶

The policy action (default for tool-call arguments) blocks the OWASP "read untrusted content, then send it to an unknown destination" pattern. It fires only when all three hold:

prior_untrusted   (an untrusted tool/resource result was read this session/turn)
∧ egress tool     (the call targets a sink: http.post, send_email, fs.write, db.write, …, or a per-tool egress=yes)
∧ new destination (the destination domain is not in the Application's allowlist)
→ BLOCK  (reasons: egress_after_untrusted_read, new_destination_domain)

This is the temporal correlation a content-only classifier misses: the arguments alone look benign — it is the sequence (tainted read → egress to a new domain) that is malicious.

Anti rug-pull (toolset signing)¶

When toolset signing is on, Geodesia stores an HMAC of each approved tool definition (name ‖ description ‖ inputSchema). On every reconnect or notifications/tools/list_changed, the hash is recomputed; any change to a previously-approved tool is reported as a rug-pull and the tool is blocked until re-approved — even if its new content scores clean, and even if the tool is marked trusted.

Configuration summary¶

See Detection Axes for what each axis detects and Enforcement Modes for how block vs annotate behaves end-to-end.