airtable · egress
Airtable: Redact PII in Record Reads
Scans the responses of the Airtable record-read tools — the calls that return row fields values — and rewrites high-confidence PII shapes to a fixed…
Policies tagged "soc2"
asana · egress
Asana: Redact PII in Task & Comment Reads
On the Asana MCP read path, this transform scans the free-text business fields that ride back in task, comment/story, and status-update responses — notes,…
bigquery · egress
BigQuery: Redact PII in Query Results
Scans the content returned by BigQuery's result-returning tools and rewrites high-confidence PII shapes to fixed, non-recoverable redaction tokens before the…
ms365 · ingress
Block Agent Email to External Recipients
Blocks agent-initiated Microsoft 365 email sends when any recipient address falls outside a corporate-domain allowlist.
bigquery · ingress
Block BigQuery Exfiltration and Cross-Project Writes
Inspects the raw GoogleSQL string carried by BigQuery SQL tools and denies any statement that moves data out of the tenant's own project — even when the call…
bigqueryguard-warehouse-exportingresssqlexfiltrationsoc2pci-dssgdpr-ccpa
snowflake · ingress
Block Bulk Export & External Staging (Snowflake)
Blocks Snowflake SQL-execution tool calls whose query text moves whole tables off the Snowflake perimeter — bulk export to cloud storage or a stage, and…
snowflakeguard-warehouse-sqlexportexfiltrationingresssoc2pci-dssgdpr-ccpa
google-calendar · ingress
Block Calendar Invites to External Attendees
Denies Google Calendar event-write tool calls — create event / create-event, update event / update-event, and the consolidated manage event — whenever any…
google-calendarguard-external-sendingresscalendarsoc2hipaagdpr-ccpa
notion · ingress
Block Destructive and Export SQL on Notion Data Sources
Inspects Notion data-source query tool calls (notion-query-data-sources on the hosted server, query-data-source on the official local server) and denies any…
snowflake · ingress
Block Destructive and Mutating Snowflake SQL
Inspects the SQL text that Snowflake MCP tools carry in their query argument and denies any statement in a mutating or destructive class — DROP, TRUNCATE,…
snowflakeguard-warehouse-sqlingresssqlreadonlysoc2pci-dsssox
bigquery · ingress
Block Destructive SQL in BigQuery Queries
Inspects the raw GoogleSQL string carried by BigQuery write-capable query tools and denies any statement in a state-changing class — DML…
zapier · ingress
Block External Sends Hidden in Zapier Instructions
Every Zapier MCP tool — in both the agentic and classic modes — accepts a free-text instructions string that Zapier's server-side AI uses to fill any…
zoom · ingress
Block External Team Chat Invites & Members
Stops a Zoom Team Chat agent from pulling external parties into the organization's chat surface.
gmail · ingress
Block Gmail Filter Creation (Auto-Forward Persistence)
Blocks the classic BEC/exfiltration persistence primitive: Gmail filters that can auto-forward or auto-delete mail and outlive the agent session.
docusign · ingress
Block Irreversible Docusign Void and Workflow Kills
Denies the irreversible destructive operations on the Docusign agent path:
linear · ingress
Block Linear Webhook Creation
Unconditionally denies any Linear tool that creates, updates, or deletes a webhook — linear createWebhook, linear deleteWebhook, and update variants.
linearguard-webhook-persistenceingresswebhookexfiltrationsoc2
ms365 · ingress
Block Mail-Rule and Webhook Persistence
Unconditionally denies the classic business-email-compromise (BEC) persistence surface in Microsoft 365: creating or updating Outlook mail rules, changing…
ms365guard-mailbox-persistenceingressbecemailfinserv-commssoc2
power-bi · ingress
Block Power BI RLS-Bypass Service-Principal Queries
On Microsoft's remote Power BI MCP server (https://api.fabric.microsoft.
dropbox · ingress
Block Public Dropbox Share, Download, and File-Request Links
Denies, by default, the Dropbox tools that turn an internal file into an internet-visible resource in a single call — before the request ever reaches Dropbox:
dropboxguard-share-linkssharingexternal-sharingingresssoc2hipaagdpr-ccpa
google-calendar · ingress
Block Public Visibility & Guest Delegation
Blocks Google Calendar create and update event calls that would expose the event to the world or hand control of it to guests.
confluence · ingress
Block Secrets in Confluence Pages and Comments
Blocks Confluence write calls whose body looks like it contains a live credential — an API key, password, token, or PEM-formatted private key — before the…
slack · ingress
Block Secrets in Slack Messages
Blocks Slack send-message tool calls whose message body looks like it contains a secret — API keys, passwords, tokens, or PEM-formatted private keys.
zoom · ingress
Block Secrets in Zoom Team Chat
Blocks Zoom Team Chat send/update tool calls whose message content looks like it contains a live secret — API keys, passwords, bearer tokens, or…
box · ingress
Box: Role-Gated Writes (Read-Only Default)
Makes Box read-only by default on the MCP path.
boxrole-gate-writesaccess-controlleast-privilegeingresssoc2gdpr-ccpa
asana · ingress
Cap Asana Batch Task Mutations
Caps the blast radius of Asana's official V2 batch write tools. At ingress it:
docusign · egress
Cap Docusign Directory and Document Egress
Bounds the two largest data-out channels in the Docusign MCP landscape:
docusigncap-bulk-exportpiidata-minimisationegresssoc2gdpr-ccpa
glean · ingress
Cap Glean Bulk Search Export
Clamps the bulk-export parameters on Glean search calls before they reach the Glean MCP server, so a single agent request cannot pull an entire indexed…
gleancap-bulk-exportdata-minimisationingresssoc2hipaagdpr-ccpa
google-drive · ingress
Cap Google Drive Search & Listing Page Sizes
Clamps the page size of Google Drive search and listing calls to a documented cap (25 results per call).
google-drivecap-bulk-exportdata-minimizationingresssoc2hipaagdpr-ccpa
intercom · ingress
Cap Intercom Contact Enumeration
caller is a CRM admin); clamp page size on everything else; allow the rest
intercomcap-bulk-exportcontact-enumerationdlpingresssoc2hipaapci-dssgdpr-ccpa
quickbooks · ingress
Cap QuickBooks Bulk Search Exports
Clamps the bulk-read levers on every QuickBooks Online search tool so an agent cannot pull the entire general ledger — or a full customer, vendor, or…
quickbookscap-bulk-exportbulk-exportdlpingresssoc2pci-dssgdpr-ccpa
airtable · ingress
Clamp Bulk Airtable Record Reads
Airtable bases routinely hold CRM contacts, applicant-tracking pipelines, customer/financial trackers, and — on HIPAA-eligible Enterprise plans — health-ops…
airtable · ingress
Confine Airtable Agent to Allowlisted Bases
An Airtable OAuth grant (or Personal Access Token) with the workspacesAndBases:read scope spans the entire workspace — every base the connected identity can…
confluence · ingress
Confluence: Deny Org-Wide & Public Publication
Stops a prompt-injected or erring agent from broadcasting Confluence content org-wide or to anonymous external readers.
confluenceatlassiandeny-public-exposurepublicationgovernanceingressfinserv-commseu-ai-actsoc2gdpr-ccpa
confluence · ingress
Confluence: Freeze Page & Attachment Deletion
Freezes the two irreversible Confluence deletion tools on the agent channel: confluence delete page and confluence delete attachment.
confluenceatlassianfreeze-destructive-opsdata-protectioningresssoc2
confluence · egress
Confluence: Redact PII from Page & Comment Responses
Scans the responses of Confluence page, comment, and search read tools and rewrites personally identifiable information to fixed redaction tokens before the…
confluenceatlassianredact-piipiidlpredactionegresssoc2hipaagdpr-ccpa
notion · ingress
Constrain Notion Connected-Tool Search
Notion's hosted MCP server (notion-search) does not just search Notion pages — through Notion AI connectors it also searches connected Slack, Google Drive,…
databricks · ingress
Databricks Default-Deny Unknown Tools
Pins an allowlist of the exact Databricks tool names your team audited and denies every other tool name on the Databricks MCP server(s).
databricksdefault-deny-unknown-toolsallowlistaccess-controlingresssoc2
databricks · egress
Databricks: Mask Cardholder PANs in Responses
Masks payment-card numbers (PANs) in Databricks tool responses before the agent receives them.
databricksmask-pan-egressegresscardholder-datadlpsoc2pci-dssgdpr-ccpa
databricks · egress
Databricks: Redact PII in Tool Responses
Scans the response payloads of the Databricks MCP tools that carry lakehouse data back to the agent and rewrites personally identifiable information to fixed…
databricks · ingress
Databricks: Role-Gate Compute & Job Control
The community JustTryAI/databricks-mcp-server exposes cluster and job control — create cluster, start cluster, terminate cluster, run job, and export…
databricksrole-gate-writesaccess-controlleast-privilegeingresssoc2
airtable · ingress
Default-Deny Unaudited Airtable Tools
Maintains a per-tenant allowlist of audited Airtable tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.
bigquery · ingress
Default-Deny Unaudited BigQuery Tools
Maintains a per-tenant allowlist of audited BigQuery tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.
bigquerydefault-deny-unknown-toolsallowlistaccess-controlingresssoc2
gusto · ingress
Default-Deny Unknown Gusto Tools
Pins an allowlist of the 36 official Gusto MCP tool names and allows a call only when lower(input.resource.name) is an exact member of that list.
linear · ingress
Default-Deny Unknown Linear Tools
Pins an audited allowlist of the verified official Linear MCP tool names and allows a call only when the incoming tool name matches an allowlisted name on…
monday · ingress
Default-Deny Unknown monday Tools
Maintains a per-tenant allowlist of audited monday tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.
power-bi · ingress
Default-Deny Unknown Power BI Modeling Tools
Pins a per-tenant allowlist of audited Power BI tool-name suffixes and denies any call whose tool name does not end with an allowlisted entry.
power-bidefault-deny-unknown-toolsallowlistmodelingingresssoc2
servicenow · ingress
Default-Deny Unknown ServiceNow Tools
Maintains an allowlist of audited ServiceNow tool-name suffixes and denies any tool call whose name does not match an allowlisted entry.
tableau · ingress
Default-Deny Unknown Tableau Tools
Fails closed on tool drift. The policy carries a pinned allowlist of the 39 tools in the verified official Tableau web toolset (tableau/tableau-mcp v2.24.
zapier · ingress
Default-Deny Unknown Zapier Tools
Maintains an allowlist of audited Zapier tool-name suffixes and denies any tool call whose name does not match an allowlisted entry, with an alert-worthy…
gmail · ingress
Deny Agent Email Sends to External Recipients
Denies Gmail send-class tool calls when any recipient in to, cc, or bcc falls outside a documented corporate-domain allowlist.
ms365 · ingress
Deny Graph API Batch Escape Hatch
Blocks the Microsoft 365 MCP server's raw-Graph passthrough tool (graph-batch, observed live as ms365-graph-batch).
stripe · ingress
Deny Stripe API-Write Escape Hatch
Denies the stripe api write meta-tool — the single raw passthrough on the official Stripe MCP server that can execute any Stripe POST, PATCH, PUT, or DELETE…
docusign · egress
Docusign: Redact SSN, Bank & Card Values on Egress
Scans the responses of Docusign envelope- and agreement-reading tools and rewrites high-confidence regulated identifiers before the response reaches the…
docusignredact-piitab-valuespiiphipandlpredactionegresssoc2gdpr-ccpa
dropbox · egress
Dropbox: Redact PII, PANs, and Secrets in File Content
Scans the responses of the Dropbox file-content read tools and sanitises the returned text before it reaches the agent.
dropboxredact-contentredact-piimask-pansecretspiidlpegresssoc2hipaagdpr-ccpa
confluence · ingress
Fence Confluence Reads & Search to Non-Restricted Spaces
Fences a configurable set of restricted Confluence spaces (placeholder keys: HR, LEGAL, SEC) out of the agent's read and search paths unless the caller's IdP…
confluenceatlassianfence-sensitive-scopesaccess-controlingresssoc2hipaagdpr-ccpa
github · ingress
Fence GitHub Access to the Company Org Allowlist
Denies any GitHub tool call whose arguments.owner (read from input.payload.args.
githubfence-sensitive-scopesorg-allowlistanti-exfilingresssoc2
glean · ingress
Fence Glean Search by Datasource
Glean's search tool fans out across every system the tenant has indexed (Drive, Confluence, Slack, Jira, Gmail/Outlook, GitHub, Salesforce, Gong, HR…
gleanfence-sensitive-scopesaccess-controldatasourceingresssoc2hipaagdpr-ccpa
gusto · ingress
Fence Gusto Compensation & Payroll Reads
Denies the highest-sensitivity Gusto read tools unless the caller's IdP-asserted groups include the placeholder group hr-payroll-admins.
gustofence-hr-and-credit-scopecompensationpayrollingresssoc2gdpr-ccpa
intercom · ingress
Fence Intercom Contact & Company PII Reads
Gates Intercom's structured-PII read surface — customer contact and company profiles — by IdP group.
intercomfence-sensitive-scopescontact-readspiiingresssoc2hipaapci-dssgdpr-ccpa
netsuite · ingress
Fence NetSuite HR & Payroll SuiteQL Queries
Fences the single biggest exfiltration surface on the NetSuite MCP server — ns runCustomSuiteQL, which runs arbitrary read-only SuiteQL across the entire ERP.
notion · ingress
Fence Notion Member Directory to Admin & IT
Denies calls to the Notion member-directory tool (notion-get-users, matched by the -get-users suffix) unless the caller's IdP groups include an admin or IT…
notionfence-sensitive-scopesaccess-controlpiiingresssoc2gdpr-ccpa
bigquery · ingress
Fence Regulated BigQuery Datasets by Group
Fences customer-designated regulated BigQuery data domains by data-domain IdP group, at ingress, before any statement or metadata lookup reaches BigQuery.
bigqueryfence-sensitive-scopesingressrbacsoc2hipaapci-dssgdpr-ccpa
google-drive · ingress
Fence Restricted Google Drive Files and Folders
Fences an admin-maintained denylist of restricted Google Drive file and folder IDs — HR records, M&A deal rooms, board packs, payroll — off the agent channel:
google-drivefence-restricted-folderssensitive-scopesingresssoc2hipaagdpr-ccpa
linear · egress
Fence Roadmap and Initiative Reads (Egress)
Fences the responses of Linear's roadmap, initiative, and strategy read tools.
box · ingress
Fence Sensitive Box Folders by IdP Group
Fences pinned sensitive Box subtrees (HR, Finance, Legal, …) by ID.
databricks · ingress
Fence Sensitive Databricks Schemas
Fences off the most sensitive lakehouse namespaces from agents on the read side of Databricks.
databricksfence-sensitive-scopesingresssoc2hipaapci-dssgdpr-ccpa
dropbox · ingress
Fence Sensitive Dropbox Paths by Team
Fences protected Dropbox subtrees by path prefix . Dropbox addresses files and folders by a root-relative path (/Finance/2026/payroll.
monday · ingress
Fence Sensitive monday Boards by IdP Group
monday boards are schemaless business databases: HR/recruiting boards (candidate PII), CRM/deal boards (financial), and IT/security trackers routinely live…
servicenow · ingress
Fence Sensitive ServiceNow Tables
Fences off the most sensitive ServiceNow tables from two routes that reach them:
servicenowfence-sensitive-tablespiiingresssoc2hipaapci-dssgdpr-ccpa
snowflake · ingress
Fence Snowflake Sensitive Schemas by Data Domain
Fences customer-designated sensitive data domains inside a Snowflake warehouse by inspecting the SQL text the agent is about to run — not by tool name, which…
snowflakefence-sensitive-scopesingresssoc2hipaapci-dssgdpr-ccpa
tableau · ingress
Fence Tableau Datasource Scope
Tableau's MCP server is a warehouse proxy: query-datasource runs a VizQL Data Service (VDS) query and returns raw row-level data — PII, PHI, payroll,…
tableaufence-sensitive-scopesaccess-controldatasourceingresssoc2gdpr-ccpa
asana · ingress
Fence Writes to Sensitive Asana Projects
Asana is routinely used for HR (hiring, performance, offboarding), legal, M&A, and incident work; those project bodies, comments, custom fields, and status…
zoom · ingress
Fence Zoom Agentic Search to Native Corpora
Constrains Zoom's agentic-search tool ( search zoom) so it can only reach Zoom-native content.
jira · ingress
Force Internal Visibility on JSM Comments
Keeps agent-drafted Jira Service Management (JSM) comments off the customer-facing portal by rewriting addCommentToJiraIssue calls to carry a restrictive…
jiraforce-internal-commentscommentsjsmservice-managementingresssoc2atlassian
servicenow · ingress
Force ServiceNow Comments to Internal Work Notes
Keeps agent-drafted ServiceNow comments off the customer/employee-visible journal by rewriting add comment calls to internal work notes.
servicenowforce-internal-commentscommentswork-notesingresssoc2finra
airtable · ingress
Freeze Destructive Airtable Deletes
Denies every destructive Airtable tool call unless the caller's IdP token carries the placeholder group airtable-admins.
google-calendar · ingress
Freeze Destructive and Series-Wide Calendar Changes
Denies irreversible Google Calendar mutations on the agent channel:
asana · ingress
Freeze Destructive Asana Operations
Denies every destructive Asana tool call unless the caller's IdP token carries the placeholder group asana-admins.
box · ingress
Freeze Destructive Box Operations
Freezes deletes and retention tampering on the community self-hosted Box MCP server (box-community/mcp-server-box).
dropbox · ingress
Freeze Destructive Dropbox Operations
Freezes the irreversible and bulk-mutation Dropbox tools on the agent channel, regardless of path. At ingress it denies, by tool-name suffix:
gmail · ingress
Freeze Destructive Gmail Operations
Denies the irreversible destruction surface that community Gmail MCP servers expose — permanent email deletion, label deletion, and filter deletion — for…
google-drive · ingress
Freeze Destructive Google Drive Operations
Blocks Google Drive delete operations issued by agents.
linear · ingress
Freeze Destructive Linear Operations
Denies destructive Linear tool calls — the delete , archive , and session-logout classes — unless the caller's IdP token carries the placeholder group…
ms365 · ingress
Freeze Destructive Microsoft 365 Operations
Denies every Microsoft 365 tool call whose verb segment is delete- or cancel- unless the caller's IdP token carries the placeholder group m365-admin.
monday · ingress
Freeze Destructive monday Operations
Splits monday's destructive tool surface into two tiers and treats each differently at ingress, before the call ever reaches the monday MCP server:
quickbooks · ingress
Freeze Destructive QuickBooks Operations
Denies every destructive QuickBooks Online (QBO) tool call on the agent channel before it reaches the MCP server.
tableau · ingress
Freeze Destructive Tableau Content Ops
Denies the irreversible content-mutation tools on the official tableau/tableau-mcp web server unless the caller's IdP token carries the placeholder group…
ms365 · ingress
Freeze M365 Identity Plane
Freezes directory and membership mutations on the Microsoft 365 MCP surface. The policy denies, by tool-name suffix:
ms365freeze-identity-planeingressidentityentragroupsiso27001-nistsoc2
notion · ingress
Freeze Notion Full-Page Content Overwrites
Denies notion-update-page calls whose command argument is replace content — the one edge on Notion's hosted MCP server that overwrites a page's entire body…
power-bi · ingress
Freeze Power BI RLS Role Edits
Freezes edits to row-level-security (RLS) roles on the Power BI MCP surface.
power-bifreeze-identity-planeingressrlsidentitygroupssoc2iso27001-nist
salesforce · ingress
Freeze Salesforce Record Deletes
Denies all Salesforce record-deletion capability on the agent channel unless the caller's IdP groups claim contains the placeholder group sf-admins.
servicenow · ingress
Freeze ServiceNow Identity Plane
Freezes the identity-and-access mutation surface of the ServiceNow MCP server. The policy denies, by tool-name suffix:
servicenowfreeze-identity-planeingressidentitygroupssoc2iso27001-nist
monday · ingress
Freeze Standing Automation & AI Agents in monday
Denies the monday tools that install side effects which outlive the governed MCP session. Two classes of tool are blocked:
zapier · ingress
Freeze the Zapier Toolset (No Self-Expansion)
In its default agentic mode, Zapier MCP exposes meta-tools that let the agent widen its own blast radius mid-session : enable zapier action and auto…
google-drive · ingress
Gate Google Drive Writes to an Authorized IdP Group
Baseline least-privilege policy for Google Drive MCP traffic.
google-driverole-gate-writesleast-privilegeingresssoc2gdpr-ccpa
zoom · ingress
Gate Zoom Transcripts & Recordings by Group
Gates retrieval of Zoom meeting transcripts, AI Companion summaries, and next-steps on the connector's core egress tools, enforcing minimum-necessary access:
github · egress
GitHub: Redact Secrets from Read Responses
Scans the responses of GitHub's crown-jewel read tools and masks known credential shapes with a fixed [REDACTED-SECRET] marker before the text enters agent…
glean · ingress
Glean Default-Deny Unknown Tools
Pins a per-tenant allowlist of the verified built-in read tools on the Glean managed remote MCP server and denies every other tool suffix on the Glean server…
gleandefault-deny-unknown-toolsallowlistaccess-controlingresssoc2
glean · ingress
Glean: Gate Memory Writes (Read-Only Default)
Gates mutating calls to Glean's long-term memory surface — the built-in tool exposed as memory (and as read memory in Glean's own client guide).
gleangate-memory-writesrole-gate-writesmemoryaccess-controlleast-privilegeingresssoc2
glean · egress
Glean: Redact PII from Read-Tool Responses
Scans the responses of Glean's content-returning read tools and rewrites high-confidence PII to fixed redaction tokens before the response reaches the…
gmail · ingress
Gmail Cap Bulk Export
Throttles mass-harvesting of a mailbox by capping the per-call blast radius of the two Gmail MCP surfaces that return many full email bodies at once:
gmailcap-bulk-exportdata-minimisationingresssoc2hipaagdpr-ccpa
gmail · ingress
Gmail: Role-Gated Writes (Read-Only Default)
Makes Gmail read-only by default on the MCP path. Verified read tools pass for everyone.
gmailrole-gate-writesaccess-controlleast-privilegeingresssoc2gdpr-ccpa
google-drive · egress
Google Drive: Redact PII from File Content
Scans the responses of the content-returning Google Drive tools — file reads, downloads, and Docs/Sheets/Slides content fetches — and rewrites personally…
google-driveredact-piipiidlpredactionegresssoc2hipaagdpr-ccpa
box · ingress
Guard Box Share Links and External Collaborations
Blocks the externally-visible Box sharing surface — the riskiest Box surface an agent can touch — before the call ever reaches Box:
boxguard-share-linkssharingexternal-sharingingresssoc2hipaagdpr-ccpa
tableau · ingress
Guard Calculation Expressions in Tableau VDS Queries
Inspects the structured VizQL Data Service (VDS) query carried by Tableau's query-datasource tool and denies the call for callers outside the data-analysts…
databricks · ingress
Guard Databricks SQL Against Writes and DDL
Inspects the SQL statement string that Databricks SQL-executing tools carry in their argument and denies any statement that performs a write, schema change,…
databricksguard-warehouse-sqlingresssqlreadonlypci-dsssoxsoc2
power-bi · ingress
Guard DAX Whole-Table Dumps in Power BI
Power BI semantic models front the warehouse: a model imports or DirectQueries lakehouse/warehouse tables — finance, HR, customer PII.
power-biguard-warehouse-sqlingressdaxexfiltrationsoc2gdpr-ccpa
docusign · ingress
Guard Docusign External Recipients
Blocks Docusign envelope-creation and recipient-update tool calls when any recipient email address has a domain outside the configured counterparty allowlist.
google-drive · ingress
Guard Drive ACL Reconnaissance
Denies Google Drive get file permissions tool calls unless the caller's IdP groups claim contains infosec. All other tool calls pass through unchanged.
ms365 · ingress
Guard OneDrive/SharePoint Share Links
Stops agents from opening OneDrive/SharePoint files to the whole internet. It guards the two Microsoft 365 sharing tools:
ms365share-linkssharingingresssoc2iso27001-nisthipaagdpr-ccpa
gusto · ingress
Gusto Cap Roster Export
Throttles full-roster exfiltration on Gusto's two broad outbound list tools — list company employees and list company contractors — by rewriting their…
gustocap-bulk-exportpiidata-minimisationingressgdpr-ccpasoc2
gusto · egress
Gusto: Redact Financial IDs in Responses
Instantiates PF-02 (redact-pii-egress) on the Gusto read path.
gustoredact-pii-egressredact-piipiifinancial-piidlpredactionegresssoc2gdpr-ccpa
hubspot · ingress
HubSpot Cap Bulk Export
Clamps the page size of HubSpot bulk-read tool calls before they reach the HubSpot MCP server, so a single agent request to a covered bulk-read tool can…
hubspotcap-bulk-exportpiidata-minimisationingresssoc2hipaapci-dssgdpr-ccpa
hubspot · ingress
HubSpot Freeze Destructive Ops
Blocks every archive/deletion-class HubSpot tool call, plus the consent-destroying contact unsubscribe, before it reaches the MCP server.
hubspot · ingress
HubSpot Read-Only
Makes the HubSpot connection read-only by blocking the write tool.
hubspotaccess-controlgovernanceread-onlyingresssoc2gdpr-ccpa
hubspot · ingress
HubSpot Role-Gate Schema and Consent
Sits one privilege tier above hubspot/role-gate-writes: ordinary crm-writers can create and edit CRM records, but two higher-blast-radius write classes are…
hubspotrole-gate-schema-consentaccess-controlleast-privilegesegregation-of-dutiesconsentingresssoc2
hubspot · ingress
HubSpot Role-Gate Writes
Gates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets…
hubspotrole-gate-writesaccess-controlleast-privilegeingresssoc2gdpr-ccpa
servicenow · ingress
Human-Only ServiceNow Change Approval
Unconditionally denies the ServiceNow change-management control-gate tools — the ones whose names end in approve change, reject change, or submit change for…
servicenowrequire-human-approvalchange-managementseparation-of-dutiesingresssoc2
intercom · ingress
Intercom: Keep Agent Help Center Articles in Draft
Keeps agent-authored Intercom Help Center articles in draft so a human reviews them before they go live on the public Help Center.
intercomdeny-public-exposureingressarticleshelp-centerpublicationgovernancesoc2
intercom · egress
Intercom: Mask Card Numbers in Conversation Responses
Masks payment-card numbers (PANs) in Intercom conversation content returned to agents by the conversation- and free-text-returning read tools.
intercommask-pan-egressegresscardholder-datadlpsoc2pci-dssgdpr-ccpa
intercom · egress
Intercom: Redact PII from Conversation & Contact Reads
Scans the free-text returned by Intercom's conversation- and contact-read MCP tools and rewrites high-confidence personal identifiers and credential shapes…
jira · ingress
JIRA: Block Change-History Actor Spoofing
Blocks any official Jira write call — transitionJiraIssue, editJiraIssue, or createJiraIssue — that carries a historyMetadata block, before it reaches the…
jiraatlassianfreeze-destructive-opsaudit-integrityingresssoc2
jira · ingress
JIRA: Cap Field and Result Exposure on Reads
Narrows the breadth of JIRA read requests before they run, on the two read surfaces that can pull large amounts of issue data into model context:
jiraatlassiancap-bulk-exportdata-minimisationingresssoc2gdpr-ccpa
jira · ingress
JIRA: Deny Sensitive Project Search and View
Keeps issues that belong to a configurable set of "sensitive" JIRA projects out of read access through the JIRA MCP server.
jiraatlassianaccess-controldata-protectioningresssoc2gdpr-ccpaiso27001-nistfinserv-comms
jira · ingress
JIRA: Freeze Destructive Issue Operations
Freezes the three irreversible Jira operations on the agent channel: jira delete issue, jira remove issue link, and jira remove watcher.
jiraatlassianfreeze-destructive-opsrecord-integritydata-protectioningresssoc2
jira · ingress
JIRA: Protect Sensitive Projects from Writes
Blocks write operations against issues that belong to a configurable set of "sensitive" JIRA projects.
jiraatlassianaccess-controldata-protectioningresssoc2gdpr-ccpaiso27001-nistfinserv-comms
jira · ingress
JIRA: Role-Gated Writes (Read-Only Default)
Makes Jira read-only by default on the MCP path.
jiraatlassianrole-gate-writesaccess-controlleast-privilegeingresssoc2gdpr-ccpa
linear · egress
Linear: Redact Customer Revenue and Contacts
Masks commercial and contact identifiers in the responses of Linear's Customers read tools before they reach the agent.
gmail · egress
Mask Card Numbers in Email Content Read by Agents
Masks payment-card-number (PAN) shapes in email content returned to agents by Gmail mailbox-read tools.
gmailmask-pan-egressegressemailcardholder-datadlpsoc2pci-dssgdpr-ccpa
ms365 · egress
Microsoft 365: Redact PII from Mail, Files & Transcripts
Scans the responses of the highest-density PII read surfaces in Microsoft 365 — mail bodies, Excel ranges, SharePoint list items, meeting transcripts, and…
monday · egress
monday: Redact PII in Board & Doc Reads
Two egress controls in one policy, both scoped to the monday MCP read path:
netsuite · ingress
NetSuite Cap SuiteQL Bulk Export
Instantiates the PF-08 cap-bulk-export family as a transform-only ingress policy on ns runCustomSuiteQL — the NetSuite MCP tool that runs arbitrary read-only…
netsuitecap-bulk-exportsuiteqldata-minimisationingresssoc2pci-dssgdpr-ccpa
netsuite · ingress
NetSuite Default-Deny Unknown MCP Tools
Pins an allowlist of the audited NetSuite MCP Standard Tools and denies every other tool call before it reaches the NetSuite AI Connector.
netsuitedefault-deny-unknown-toolsallowlistaccess-controlingresssoc2
netsuite · egress
NetSuite: Redact Financial PII in Responses
Instantiates PF-02 (redact-pii-egress) on the NetSuite read path.
netsuiteredact-piipiifinancial-piidlpredactionegressgdpr-ccpasoc2
notion · egress
Notion: Redact PII from Read Responses
Scans the responses of the Notion hosted MCP server's content-returning read tools and rewrites personally identifiable information to fixed redaction tokens…
power-bi · egress
Power BI: Redact PII in Query Results
Scans the content returned by Power BI's result-returning tools and rewrites high-confidence PII shapes to fixed, non-recoverable redaction tokens before the…
github · ingress
Prevent Public Exposure of GitHub Repos, Gists & Forks
Stops the agent from exposing private code to the public across three GitHub write tools, at ingress — before the call reaches the GitHub MCP server, so a…
githubdeny-public-exposureanti-exfilingresssoc2finserv-commseu-ai-act
quickbooks · egress
QuickBooks: Redact Employee & Vendor PII on Read
On the read path, this policy masks sensitive identifiers in the responses of four QuickBooks Online (QBO) name-entity read tools — get employee, search…
ms365 · ingress
Read-Only Baseline: Group-Gated Microsoft 365 Writes
The least-privilege baseline for Microsoft 365 through the gateway: every tool call is allowed only if it is a read , or the caller's IdP token carries the…
github · ingress
Read-Only GitHub for Non-Engineers
Establishes the least-privilege baseline for the GitHub MCP connector on the agent channel.
stripe · ingress
Read-Only Stripe by Default (Role-Gate Billing Writes)
Establishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools —
striperole-gate-writesingressleast-privilegerbacsoc2pci-dsssoxgdpr-ccpa
google-calendar · egress
Redact Attendee PII and Meeting Links in Calendar Reads
Scrubs sensitive fields from the responses of Google Calendar read tools before they reach the agent, for callers who lack the placeholder calendar-full-read…
google-calendarredact-piipiiphidlpredactionegresssoc2hipaagdpr-ccpa
github · ingress
Require Human Approval: GitHub Merges & Approvals
Keeps a human in the loop on the two GitHub actions that consummate a code change: merging a pull request and approving one .
zapier · ingress
Role-Gate All Zapier Writes
Zapier MCP is an aggregator: one connector proxies actions across 9,000+ apps, and every create/update/delete/send funnels through a small, predictable…
dropbox · ingress
Role-Gate Dropbox Writes to the Writers Group
Establishes the per-app least-privilege write floor for Dropbox.
dropboxrole-gate-writesrbacleast-privilegeingresssoc2gdpr-ccpa
salesforce · ingress
Salesforce Cap Bulk Data Export
Blocks bulk PII extraction through Salesforce query tools by inspecting the free-text query arguments that are the real policy surface for these servers.
salesforcecap-bulk-exportdata-minimizationdlpingresssoc2hipaapci-dssgdpr-ccpa
salesforce · ingress
Salesforce Deny API Escape Hatches
Unconditionally denies the raw-code and raw-API tools exposed by the community Salesforce MCP servers — tools that bypass every object- and argument-level…
salesforcedeny-escape-hatchesaccess-controlingresssoc2iso27001-nist
salesforce · ingress
Salesforce Protect Contact Fields
Blocks Salesforce Contact updates that modify protected fields — ownership, account linkage, contact PII, name, and consent flags.
salesforcecontactspiiaccess-controlgovernanceingresssoc2gdpr-ccpaiso27001-nist
salesforce · ingress
Salesforce Query Allowlist
Restricts Salesforce SOQL queries so only Account, Contact, and Opportunity records can be retrieved.
salesforceaccess-controldata-protectiongovernanceingresssoc2pci-dssgdpr-ccpaiso27001-nist
salesforce · ingress
Salesforce Read-Only Access
Restricts the Salesforce MCP server to read-only access.
salesforceaccess-controlgovernanceread-onlyingresssoc2gdpr-ccpaiso27001-nist
salesforce · egress
Salesforce Redact PII
Redacts personal contact information from Salesforce tool responses before they reach the caller.
salesforcepiidlpredactionegresssoc2hipaagdpr-ccpaiso27001-nist
salesforce · ingress
Salesforce Role-Gated Writes
The PF-12 least-privilege baseline for Salesforce.
salesforcerole-gate-writesaccess-controlleast-privilegeingresssoc2gdpr-ccpacrm
stripe · ingress
Scrub Unapproved Stripe Payment-Link Redirects
Scrubs the post-payment redirect from Stripe payment-link creation calls.
stripeguard-share-linksingresstransformphishingprompt-injectionsoc2
servicenow · ingress
ServiceNow: Role-Gated Writes (Read-Only Default)
else fails closed
servicenowrole-gate-writesaccess-controlleast-privilegeingresssoc2gdpr-ccpa
slack · ingress
Slack Role-Gate Writes
Gates every Slack write-class tool behind an IdP group: callers whose JWT groups claim contains slack-writers may send and schedule messages, add or remove…
slackrole-gate-writesaccess-controlleast-privilegeingresssoc2gdpr-ccpa
slack · ingress
Slack: Block Agent Posts to External Channels
Denies Slack message-write calls whose destination is an externally shared Slack Connect channel.
slackguard-external-sendslack-connectexfiltrationingresssoc2gdpr-ccpahipaa
slack · ingress
Slack: Deny Channel Creation
Blocks Slack channel-creation tool calls at ingress. Every other Slack tool — and every non-Slack tool — passes through untouched.
slack · ingress
Slack: Deny DM and Private-Conversation Reads and Search
Denies the agent read reach into Slack DMs and private conversations on the paths below — the workspace's highest concentration of PII/PHI (HR issues, health…
slack · ingress
Slack: Deny Read/Search/Summarize of Sensitive Channels
Blocks read, search, and summarize operations that target a configurable set of "sensitive" Slack channels.
slackaccess-controldata-protectioningresssoc2hipaagdpr-ccpaiso27001-nist
slack · ingress
Slack: Deny Sending Direct Messages
Blocks Slack message-write calls whose destination resolves to a direct conversation — a 1:1 DM, a message posted to a user ID (which Slack auto-opens as a…
slackaccess-controlgovernanceingresssoc2iso27001-nistfinserv-comms
slack · egress
Slack: Mask Card Numbers in Message and Search Responses
Masks payment-card numbers (PANs) in Slack content returned to agents by message-read, thread-read, canvas-read, history, and search tools.
slackmask-pan-egressegresscardholder-datadlppci-dsssoc2gdpr-ccpa
snowflake · ingress
Snowflake Default-Deny Unknown Tools
Pins an allowlist of the exact Snowflake tool names your team audited and denies every other tool name on the Snowflake MCP server(s).
snowflakedefault-deny-unknown-toolsallowlistaccess-controlingresssoc2
snowflake · ingress
Snowflake Deny Composite & Generic Tools
Denies the opaque composite and generic passthrough tools on the Snowflake-managed MCP server whose execution the gateway cannot inspect one SQL statement at…
snowflakedeny-escape-hatchesaccess-controlcortexingresssoc2iso27001-nist
snowflake · egress
Snowflake: Redact PII from Query Result Sets
Scans the row content returned by the result-returning Snowflake MCP tools and rewrites personally identifiable information to fixed redaction tokens before…
stripe · egress
Stripe: Redact Customer PII from Bulk Reads
Masks customer PII in the responses of Stripe's bulk PII egress channels before they reach the agent.
tableau · egress
Tableau: Redact PII & Mask PANs in Query Results
Tableau is a warehouse proxy: the data-returning tools stream raw row-level content out of whatever the published datasource connects to — PII, PHI, payroll,…
tableauredact-pii-egresspiipandlpredactionegresssoc2gdpr-ccpa
zapier · egress
Zapier: Mask Card Numbers in Read Responses
Masks payment-card numbers (PANs) in Zapier MCP read responses before they reach the agent.
zapiermask-pan-egressegresscardholder-datadlpsoc2pci-dssgdpr-ccpa
zoom · egress
Zoom: Redact PII in Meeting Intelligence
Scans the responses of Zoom's meeting-intelligence read surfaces — AI summaries, verbatim transcripts, recording resources, and Zoom Docs content — and…