Govern Agent Tool Calls and MCP Tools

AI agents use tools, and each tool call can change data or systems. Verdictan has different controls for different parts of this traffic. This article helps you to select the correct control.

Compare the controls

Surface	What it examines	Page
tool-security	The full incoming request, including messages and tool definitions, before the model call	Tool Security
agent-firewall	The tool calls in model traffic, in the request and the response	Agent Firewall
Gateway MCP endpoint	The Verdictan tools that an MCP client calls on a published agent hostname	Connect an MCP Client

tool-security does not examine the tool calls that the model generates later. Use agent-firewall for those calls. Also enforce permissions in the tool executor.

Allow and block model tool calls

Start with the simple shape of agent-firewall:

policy-config.yaml

pack:
  name: agent-firewall-simple
  version: 1.0.0
  enabled: true
policies:
  chain:
    - agent-firewall
policy:
  agent-firewall:
    allowed_tools:
      - read_*
      - search
    blocked_tools:
      - rm_rf
    max_actions_per_session: 50

With this configuration, search and read_document are allowed. rm_rf is blocked. write_document is also blocked, because no rule allows it.

A block returns HTTP 400 with the error code content_policy_violation. A request without tool calls is never blocked by this control.

Block unsafe request payloads

tool-security in local mode looks for built-in attack patterns, such as ../, rm -rf, and 169.254.169.254. It also looks for sensitive entity types, such as private_key and aws_access_key, and for your own blocked_patterns.

The local checks match substrings in the serialized request JSON. They do not parse tool arguments, so ../ also matches a relative path in a message.

Know the limits

• The agent-firewall counts apply to one request or response only. The gateway keeps no counters between requests, so these counts are not durable rate limits.
• Role rules in agent-firewall use only the verified identity. An X-User-Role header does not select a role.
• The MCP endpoint operates only on a published hostname. Use an Access Key or a Gateway Key from API Tokens. Do not use the credential that starts the gateway.

Next steps

• Agent Firewall: role rules, transaction limits, and kill switches.
• Tool Security: local checks and the external firewall mode.
• Configure Policies for IDE Traffic: controls for coding assistants and their tool calls.