mcp · tool safety
how do I secure an mcp server against destructive tool calls?
Don't trust the model to use dangerous tools carefully — put a deterministic veto in front of the tool calls. gate.cat inspects each action an MCP-connected agent tries (file deletes, database drops, cloud teardown, collection wipes) and blocks the irreversible ones before they execute, failing closed.
Run it as a Claude Code hook, or as a proxy the agent routes through — pip install gate-cat, free, Apache 2.0.
The Model Context Protocol (MCP) is powerful because it gives an agent real tools. That is also the risk: an MCP server can expose delete_file, a database client, a cloud SDK or a vector-store admin API — and an agent that misreads intent can call the irreversible one.
where MCP goes wrong
An MCP tool call is a structured request to do something. Most servers apply little semantic checking — if the tool exists and the arguments parse, it runs. So the danger surface is exactly the destructive verbs:
- Filesystem servers: recursive delete, overwrite, move-outside-root.
- Database servers:
DROP TABLE,DELETEwithout aWHERE,TRUNCATE. - Cloud / infra servers: terminate instances,
terraform destroy, delete buckets, revoke keys. - Vector-store / model servers: drop a collection,
ollama rma model, delete an embedding index.
Restarting a stopped instance is recoverable. Dropping a collection or deleting a bucket is not. The goal is a wall around the irreversible subset.
put the veto in front of the tools
gate.cat is a deterministic deny-list that evaluates an action before it executes and fails closed. Two ways to place it in an MCP setup:
- Claude Code hook. Tool calls from MCP servers flow through the
PreToolUsehook, so the veto covers them natively — no per-server wiring. - Proxy. For any OpenAI-API agent driving MCP tools, point the agent's
base_urlat the gate.cat proxy. The proxy's/healthendpoint reports its mode so a misconfigured (silent) gate is detectable — silence is never assumed to mean safe.
The 38 default policies already cover the classic irreversible shapes across shell, SQL and cloud. For local-model and MCP stacks specifically, the optional Local-Agent policy pack adds deny rules for ollama rm, LM Studio model removal, and destructive vector-store calls (for example an HTTP DELETE against a Qdrant collection) — breadth for that stack, on top of the same free engine.
frequently asked
Does gate.cat inspect MCP tool calls or just shell commands?
Both. In Claude Code, MCP tool calls flow through the same PreToolUse hook as shell commands, so the deny-list covers them. Through the proxy, any action an OpenAI-API agent takes is evaluated before it runs.
What extra does the Local-Agent policy pack add for MCP?
Stack-specific breadth, not more core safety: deny rules for local-model and MCP tooling such as ollama rm, LM Studio model removal, and destructive vector-store calls like an HTTP DELETE against a collection. It is a one-time $29 add-on; the free core already blocks the classic shell/SQL/cloud shapes.
Can the agent route around the proxy?
The proxy only sees traffic that is pointed at it — that is an operator base_url setting, not a gate.cat guarantee. The proxy's /health endpoint and a startup banner surface the current mode so a bypassed or disabled gate is visible rather than silent.
Is gate.cat itself an MCP server?
No. gate.cat is a veto layer that sits in front of agents and their tools (including MCP tools). It is a Claude Code hook and an OpenAI-API proxy, not an MCP server you register as a tool.
Does securing MCP calls slow the agent down?
The check is a local regex evaluation and intervenes on roughly 0.6% of real commands. Benign tool calls pass straight through; only the irreversible shapes are stopped.
put a leash on your agent — 60 seconds
The gate, all 38 default policies, the Claude Code hook and the proxy are free forever (Apache 2.0). No account, no daemon, no telemetry.
Running agents across a team? One rogue agent is the whole team’s blast radius. See the team plan — €149/mo flat →
One email when there's a catch worth showing: a real irreversible command an agent tried, and how the wall stopped it. Opt-in, no spam, no telemetry. The gate itself is free.
✓ you're on the list — first catch lands soon.