Introduction

Every MCP server is created in control mode: tool input and output are checked against the server's policies on every call.

What happens on a policy hit

A blocked call returns the policy message to the client. Output can be masked instead of blocked. If the policy check itself cannot run, the call fails closed.

What gets recorded

Each call is recorded with one of these outcomes:

• Denied by policy

• Tool not exposed

• Gateway error

• Timeout

• Upstream error

Incidents and Policies tabs

These two tabs currently show chat-scoped incidents and policies; MCP-specific incident and policy views are on the roadmap.