MCP Tool Access Control

MCP Tool Access Control is a Content Security ProviderContent Security: Content Security Providers govern the MCP tool traffic flowing through Aembit's MCP Identity Gateway. You add a provider to the Content Security component of an Access Policy.Learn more that governs which Model Context Protocol (MCP)Model Context Protocol: A standard protocol for AI agent and server interactions that defines how AI assistants communicate with external tools and data sources.Learn more(opens in new tab) tools an AI agent can discover and which it can call.

Authorizing an MCP ServerMCP Server: A server that implements the Model Context Protocol to provide tools, resources, or data to AI agents and MCP clients.Learn more(opens in new tab) grants an AI agent access to every MCP tool that the MCP server exposes. MCP Tool Access Control lets you control that access. You choose which MCP tools to allow and which to block. The MCP Identity GatewayMCP Identity Gateway: A component that brokers MCP traffic between MCP clients and target MCP servers, validating authorization and presenting Aembit-managed credentials on each request.Learn more enforces your choices on every request your Access PolicyAccess Policy: Access Policies define, enforce, and audit access between Client and Server Workloads by cryptographically verifying workload identity and contextual factors rather than relying on static secrets.Learn more governs.

An Access Policy can carry both MCP Tool Access Control and CrowdStrike AI Detection and Response (AIDR)AIDR: CrowdStrike AI Detection and Response (AIDR) is a content inspection service that scans MCP tool listings, tool call inputs, and tool call outputs in real time and returns an allow, block, or transform verdict to Aembit.Learn more. MCP Tool Access Control matches tool names first, so AIDR inspects only the MCP tools and calls that MCP Tool Access Control allowed.

Note

MCP Tool Access Control isn’t enabled by default. Contact Aembit support to enable this feature.

To add MCP Tool Access Control to an Access Policy, see Add MCP Tool Access Control to an Access Policy.

What AI agents can discover and call

MCP Tool Access Control governs how AI agents discover MCP tools and how they call them. You add the MCP tools you want to govern, then allow or block them.

• The Tool VisibilityTool Visibility: A control that governs which MCP tools an agent can discover when it requests a tool listing.Learn more control decides which MCP tools an AI agent discovers when it asks an MCP server what MCP tools exist. A blocked MCP tool never appears in that listing.
• The Tool InvocationTool Invocation: A control that governs which MCP tools an agent can call, independently of which tools it can discover.Learn more control decides which MCP tools an AI agent can call. The MCP Identity Gateway returns an error for a call to a blocked tool and never forwards it to the MCP server.

Both controls act on standard MCP methods, tools/list and tools/call. See Proxied MCP methods.

Aembit records what each control decided in the Workload EventWorkload Event: A structured audit record that Aembit generates when application-level traffic flows through Agent Proxy or MCP Identity Gateway.Learn more, so an event shows why an AI agent didn’t discover an MCP tool or why a call failed.

Hide and block to fully deny an MCP tool

Tool Visibility and Tool Invocation evaluate independently.

Tool Visibility can block an AI agent from discovering a tool. Tool Invocation can block an AI agent from calling an MCP tool it knows about.

If an AI agent already knows about an MCP tool you blocked with Tool Visibility alone, it can still call it. Block an MCP tool in both controls when you want to be certain an AI agent can’t call it.

MCP tool names

Aembit doesn’t collect or store the MCP tool list from an MCP server, so you need to know the MCP tool names you want to govern. Take them from the MCP server’s documentation, which lists the names it publishes, such as get_issue.

An AI agent’s MCP tool list shows different names

The MCP Identity Gateway prefixes every MCP tool with the Server WorkloadServer Workload: Server Workloads represent target services, APIs, databases, or applications that receive and respond to access requests from Client Workloads.Learn more it came from, so the names an AI agent displays don’t match what the MCP server publishes. Use the name the MCP server publishes before the MCP Identity Gateway prefixes it or the entry can’t match.

You can add an exact name or a glob pattern, and matching is case-sensitive. For the full syntax and the field limits, see MCP Tool Access Control tool name reference.