Skip to content

MCP security

Decide every MCP tool call that runs through Vekri, on the laptop and in the cluster.

Vekri gives MCP servers two control points. On workstations, the local MCP gateway runs an approved server behind Vekri Endpoint and asks Vekri to decide each call. For shared systems, Vekri Gateway authorizes every remote MCP call and executes it with credentials the agent never holds.

Contact SalesRequest a Demo

The problem

Why it matters.

An MCP server gives an agent real capabilities: repositories, tickets, payments, infrastructure. Most are configured by hand on a laptop, with a long-lived token and no record of what was called.
  1. 01

    Inventory

    Vekri Endpoint lists the MCP servers each supported client is configured to use, and whether Vekri mediates them.

  2. 02

    Approve as a profile

    A local MCP profile names the server, the clients that may use it, and which tools are allowed, need approval or are denied, for which resources.

  3. 03

    Decide each call

    Every tools/call is checked against the profile, Cedar policy and the person's verified binding to the device. A denied call never reaches the server.

  4. 04

    Inspect results

    Tool results are inspected for prompt injection before the agent reads them, and every decision is recorded.

See it work

Step by step.

Local MCP gateway
Illustrative data

Claude Code

On Erin's laptop

Vekri

Profile · Cedar · approvals

vekri-endpoint mcp proxy

Local MCP gateway · profile github-eng

list_issues · allow
create_pull_request · approved, ran once
delete_repository · deny (profile)
Vekri unreachable · failed closed

Denied: delete_repository

GitHub MCP server

Started by the proxy

Received: list_issues

Received: create_pull_request

Never received: delete_repository

Decisions · user:erin · device ws-dev-07

  • Allowedlist_issues
  • Approvedcreate_pull_requestsingle use
  • Denieddelete_repositorynot executed

What happens

Applies to MCP servers configured through a Vekri profile. Built-in tools and servers configured directly are outside it, and inventory shows them as not mediated.

Capabilities

What Vekri does today.

Each item is in the current release and verified by tests in the product repository, with its limits beside it.

  • Vekri Endpoint

    MCP client and server inventory

    Lists the MCP servers configured in each supported client (name, transport, command or host), and whether each is mediated by Vekri. Servers are never started and credential values are never read.

    Vekri Endpoint inventory · macOS, Linux

  • Vekri Endpoint

    Local MCP gateway

    Runs an approved MCP server behind vekri-endpoint, and asks Vekri to decide every tool call before it reaches the server. A denied call never runs; an enforced profile fails closed when Vekri cannot be reached, and refuses MCP resources, prompts, sampling and elicitation, which no rule governs yet.

    local MCP gateway · macOS, Linux

    Limit: Governs the MCP servers configured through a Vekri profile; built-in tools (shell, file edits) and servers configured directly stay outside it, and inventory shows them as not mediated. Claude Code was verified connecting through it; in the tests, tool calls are made by an MCP client library rather than by Claude's model.

  • Vekri Protect

    Managed local MCP profiles

    Approve an MCP server once as a profile: which clients, which tools are allowed, need approval or are denied, and for which resources. Vekri Endpoint configures it in the client and decides every tool call sent through it.

    local MCP gateway · macOS, Linux

  • Vekri Gateway

    OAuth-protected MCP gateway

    Agents reach systems through one MCP gateway. Every request carries a token for exactly one connector, verified on each call; incoming tokens are never forwarded.

    Vekri Gateway (remote MCP) · Kubernetes

    Limit: Vekri is a boundary only when the gateway is the only path to the protected system.

  • Vekri Gateway

    Cedar policy, deny by default

    Typed operations are evaluated with Cedar. Unknown operations and policy errors are denied, and a policy revision can be simulated before it is published.

    Vekri Gateway (remote MCP) · local MCP gateway · Kubernetes

  • Vekri Gateway

    Exact-operation approvals

    A privileged write waits for another person to approve that exact operation. The approval is bound to the request's digest, short-lived and single use.

    Vekri Gateway (remote MCP) · local MCP gateway · Kubernetes

  • Vekri Gateway

    Credential broker

    The broker executes each allowed operation with its own narrowly scoped Kubernetes or GitHub App credential. The agent never receives it.

    Vekri Gateway (remote MCP) · Kubernetes

  • Vekri Endpoint

    Prompt-injection detection on the local MCP gateway

    Tool results from a mediated MCP server are inspected on the workstation before the AI client sees them. Only evidence reaches Vekri, which decides under policy; enforced profiles withhold when Vekri cannot be reached, once the device has received a policy.

    local MCP gateway · macOS, Linux

    Limit: Only results that pass through the local MCP gateway are inspected.

  • Vekri Gateway

    Prompt-injection detection on Vekri Gateway

    Each tool result is inspected for instructions aimed at the agent after the operation runs and before the agent reads it. Policy can deliver it, replace the matching text, withhold it, or hold it for a person to release once.

    Vekri Gateway (remote MCP) · Kubernetes

    Limit: Detection misses some paraphrased injections: on a held-out test set the default configuration found 59% at an 8% false-positive rate.

Not yet available

  • PreviewLocal MCP gateway for other clients. The configuration is written and verified by parsing; no live session of these clients has used the gateway.

Listed so you know where the edges are. Ask us before relying on anything here.

Products

Where it comes from.

Related capabilities

Contact Sales

See Vekri with your own AI applications, agents and systems.

Talk to us about the AI your organization uses, the systems agents reach and how you deploy: in Vekri's cloud, or inside your own Kubernetes cluster.

Contact SalesRequest a Demo