Protect Policy

Protect applies your scanner’s Block and Mask actions to supported endpoint tool calls. Its source policy is allow unless denied: configured MCP sources continue to run unless they match an entry on the Protect denylist. This is intentionally different from Enforce policy, which denies configured MCP sources unless they match an Enforce allowlist. Protect denylists apply only in Protect mode; Enforce ignores them.

​

Where to configure it

Admins with the Manage org settings capability edit the policy under Settings → Tool governance → Protect. The Protect tab appears when Protect mode is available for the organization. The editor has three groups — Denied remote MCP URLs, Denied local (STDIO) packages, and Denied built-in MCP servers. The page saves Protect and Enforce settings together, so unchanged policy groups are preserved.

​

Decision behavior

For a configured MCP source in Protect:

1. Runlayer-managed MCP sources are allowed.
2. A source that matches the applicable denylist is blocked with an organization-denylist decision.
3. An unmatched source is allowed and continues through Protect’s normal content-scanner path.
4. If Runlayer cannot evaluate source governance — for example because the policy service is unreachable, the response comes from an older backend, or a local command cannot be parsed into a package identity — the source check fails open and content scanning still runs.

​

Denied remote MCP URLs

Add the base URL of an external remote MCP server that Protect should block. You can configure up to 50 entries. Matching uses the same URL rules as the Enforce allowlist:

• Scheme, host, and port must match. Default ports 443 and 80 are equivalent to omitting the port.
• An origin-only entry matches every path on that origin.
• An entry with a path matches that path and its descendants on a path boundary. For example, /mcp matches /mcp/stream but not /mcpbackup.

URLs that do not match remain allowed.

​

Denied local (STDIO) packages

Protect can block a local MCP launched through a recognized npm or PyPI package runner. Each entry contains:

• Ecosystem — npm or PyPI
• Package name — the canonical package identity
• Version — optional; omit it to deny every version, or set an exact version to deny only that version

You can configure up to 100 entries. Package parsing and normalization follow the same rules described under Enforce package identity. Protect is fail-open for source governance. A command that cannot be safely resolved to one package identity does not match the denylist and remains eligible for content scanning.

​

Denied built-in MCP servers

Some AI clients provide built-in MCP servers that have no URL or local command. Add a (client, built-in server id) pair to block that server in Protect. You can configure up to 100 entries. The pair must match exactly. An unidentified or unmatched built-in server remains allowed in Protect.

​

Related resources