Govern every MCP tool call.
Before damage is done.
Model Context Protocol connects AI agents to powerful tools — file systems, databases, APIs, email. Without governance, that's an enormous attack surface. Prefactor authenticates MCP servers, scopes tool access per agent, and audits every invocation.
MCP is powerful. Ungoverned MCP is a liability.
MCP server adoption is accelerating across enterprise AI teams. Most deployments have no server authentication, no tool permission scoping, and no audit trail. That creates four categories of serious risk.
Tool Poisoning
A malicious or compromised MCP server injects hidden instructions into its tool responses, manipulating agent behaviour without the user's knowledge — causing the agent to exfiltrate data, take unauthorised actions, or bypass safety controls.
Data Exfiltration via Tools
An over-privileged tool call reads sensitive data — customer PII, financial records, API credentials — and returns it to an agent that then leaks it through its output channel. Without tool permission scoping, agents access far more data than any task requires.
Server Impersonation
A malicious server mimics a legitimate MCP endpoint, intercepting agent requests, harvesting credentials, and injecting false responses. Without server identity verification, agents cannot distinguish legitimate tools from adversarial ones.
Privilege Escalation via Tool Chains
An agent approved to use one tool invokes a second tool that grants broader access — escalating privileges through a chain of MCP calls. Each step looks legitimate; the combined effect violates least-privilege policy.
Four controls. One governance layer.
Prefactor sits between your agents and their MCP servers — applying governance controls at the protocol layer without requiring changes to agent code.
MCP Server Registry & Authentication
Prefactor maintains a curated registry of approved MCP servers, each with a verified identity. Agents can only connect to registered servers — connection attempts to unregistered or unknown endpoints are blocked and logged. Server identities are verified cryptographically, not by hostname or URL alone.
Per-Agent Tool Permission Scoping
Each agent is assigned a tool permission scope that lists exactly which tools it is approved to invoke — for which tasks and under which conditions. An agent approved to use a search tool cannot call a write or delete tool even if the MCP server exposes them. Scope violations are blocked inline before the call is forwarded.
Full Tool Call Audit Trail
Every MCP tool invocation is recorded — the calling agent identity, the tool name, the input parameters, the response received, the policy decision applied, and the timestamp. The audit trail is immutable and exportable for compliance reviews, security investigations, and incident response.
Anomaly Detection & Alerting
Prefactor monitors tool call patterns in real time — flagging unusual sequences, unexpected parameter sizes (potential data exfiltration), out-of-hours access, and tools being called in new or unexpected combinations. Anomalies trigger alerts, escalation, or automatic blocking depending on policy configuration.
Everything your security team needs to govern MCP.
Server Whitelist Enforcement
Block connections to any MCP server not on your approved registry. Maintain separate whitelists by environment, team, or agent classification.
Tool-Level Permission Policies
Define which tools each agent can call — by tool name, tool category, or tag. Policies are version-controlled and auditable.
Parameter Inspection
Inspect tool call parameters for PII, credentials, oversized payloads, and policy violations before forwarding requests to MCP servers.
Response Inspection
Inspect MCP server responses for injected instructions, sensitive data, and anomalous content before the response reaches your agent.
Rate Limiting per Agent
Enforce per-agent tool call rate limits and token budgets. Detect and contain runaway agents before they exhaust API quotas or incur unexpected costs.
Human-in-the-Loop Approval
Route high-risk or anomalous tool calls to a human reviewer before execution. Configure approval requirements by tool type, risk score, or data sensitivity.
MCP security controls that map to your compliance framework.
Prefactor's MCP governance layer generates the continuous monitoring evidence, audit trails, and policy enforcement records your compliance team needs — mapped to the frameworks you already operate under.
Key MCP security concepts
Explore the terminology behind MCP security in our AI agent governance glossary.
MCP Security Questions
What is MCP security?
What are the biggest security risks in MCP deployments?
How does Prefactor secure MCP server connections?
Does Prefactor work with all MCP servers?
What is tool poisoning and how does Prefactor prevent it?
Can I restrict which MCP tools individual agents can use?
How does MCP security relate to AI agent governance more broadly?
Govern your MCP deployment.
Book a session with the Prefactor team to see how MCP security governance works in your environment.
Book a demoSee It In Action
A single control plane for every agent across every framework. From mission control to audit trails.
Unified control center for agents, authentication, and risk management