> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Protect Policy

> Block explicitly denied MCP sources in Protect while allowing unmatched sources

Protect applies your scanner's Block and Mask actions to supported endpoint tool calls. Its source policy is **allow unless denied**: configured MCP sources continue to run unless they match an entry on the Protect denylist.

This is intentionally different from [Enforce policy](/shadow-ai/enforce/policy), which denies configured MCP sources unless they match an Enforce allowlist. Protect denylists apply only in Protect mode; Enforce ignores them.

## Where to configure it

Admins with the **Manage org settings** capability edit the policy under **Settings** → **Tool governance** → **Protect**. The Protect tab appears when Protect mode is available for the organization.

The editor has three groups — **Denied remote MCP URLs**, **Denied local (STDIO) packages**, and **Denied built-in MCP servers**. The page saves Protect and Enforce settings together, so unchanged policy groups are preserved.

## Decision behavior

For a configured MCP source in Protect:

1. Runlayer-managed MCP sources are allowed.
2. A source that matches the applicable denylist is blocked with an organization-denylist decision.
3. An unmatched source is allowed and continues through Protect's normal content-scanner path.
4. If Runlayer cannot evaluate source governance — for example because the policy service is unreachable, the response comes from an older backend, or a local command cannot be parsed into a package identity — the source check fails open and content scanning still runs.

<Note>
  The denylist governs **where an MCP call comes from**. It does not replace
  content scanning. An MCP source that is not denied can still be blocked or
  masked by your configured scanners.
</Note>

## Denied remote MCP URLs

Add the base URL of an external remote MCP server that Protect should block. You can configure up to **50** entries.

Matching uses the same URL rules as the Enforce allowlist:

* Scheme, host, and port must match. Default ports `443` and `80` are equivalent to omitting the port.
* An origin-only entry matches every path on that origin.
* An entry with a path matches that path and its descendants on a path boundary. For example, `/mcp` matches `/mcp/stream` but not `/mcpbackup`.

URLs that do not match remain allowed.

## Denied local (STDIO) packages

Protect can block a local MCP launched through a recognized npm or PyPI package runner. Each entry contains:

* **Ecosystem** — `npm` or `PyPI`
* **Package name** — the canonical package identity
* **Version** — optional; omit it to deny every version, or set an exact version to deny only that version

You can configure up to **100** entries. Package parsing and normalization follow the same rules described under [Enforce package identity](/shadow-ai/enforce/policy#package-identity).

Protect is fail-open for source governance. A command that cannot be safely resolved to one package identity does not match the denylist and remains eligible for content scanning.

## Denied built-in MCP servers

Some AI clients provide built-in MCP servers that have no URL or local command. Add a `(client, built-in server id)` pair to block that server in Protect. You can configure up to **100** entries.

The pair must match exactly. An unidentified or unmatched built-in server remains allowed in Protect.

## Related resources

<CardGroup cols={2}>
  <Card title="Enforce policy" icon="shield" href="/shadow-ai/enforce/policy">
    Configure deny-by-default allowlists and built-in tool blocks for Enforce
  </Card>

  <Card title="Deploy AI Watch" icon="download" href="/shadow-ai/deploy">
    Select Monitor, Protect, or Enforce for managed devices
  </Card>

  <Card title="Protect and Enforce" icon="shield" href="/shadow-ai/enforce">
    Understand endpoint modes, scanner decisions, and source governance
  </Card>

  <Card title="Detect" icon="eye" href="/shadow-ai/detect">
    Discover shadow MCP servers across your device fleet
  </Card>
</CardGroup>