MCP security — per-tool allow/deny, agent guardrails, auth gates, and human approval for AI agents
Your AI agents have root access.
Enforce MCP security before it costs you.
Every MCP server you install gives your AI agent unrestricted access to your databases, repos, cloud, and APIs. No permissions. No guardrails. One hallucination away from disaster. Aerostack enforces MCP security at the tool level with per-tool allow/deny scopes, composable agent guardrails that block PII and policy violations, and human approval gates for irreversible actions.
What your AI agent can do right now.
Install any MCP server in Claude, Cursor, ChatGPT, or Windsurf. Your agent immediately gets full, unrestricted access to every tool. Here's what that means.
Database MCP
Any AI agent with Postgres/MySQL MCP
DROP TABLE users critical DELETE FROM orders WHERE 1=1 critical UPDATE accounts SET balance = 0 SELECT * FROM credit_cards ALTER TABLE — break schema GitHub MCP
Any AI agent with GitHub MCP
Delete repository critical Force push to main critical Merge PRs without review Change branch protection rules Remove collaborators Slack MCP
Any AI agent with Slack MCP
Send messages as you to any channel critical Delete channels critical Remove members from workspace Export private conversations Change workspace settings Cloud (AWS/GCP) MCP
Any AI agent with Cloud MCP
Terminate production instances critical Delete S3 buckets with data critical Modify security groups (open ports) Change IAM policies Download secrets from vault
Toggle permissions.
See what your agent can do.
This is the Aerostack permission panel. Every MCP tool can be individually enabled or disabled. Your agent only sees what you allow.
When your agent calls a blocked tool, Aerostack returns a clear error — the action is never executed.
Four layers of agent safety.
Aerostack sits between your AI agent and your tools. Every tool call, every output, and every sensitive action goes through enforcement checks — not advisory rules.
MCP Scopes — Per-Tool Allow/Deny
Configure exactly which tools each agent can call via mcp_scopes. The call is rejected before it reaches the MCP server. Least-privilege at the permission layer, not the prompt layer.
Agent Guardrails — I/O Checks
The guardrail node runs PII detection, regex blocklist, prompt-injection heuristic, output-length caps, cost budgets, topic scope, and content policy on agent I/O — routing to pass or blocked.
Auth Gate — Identity Before Action
Require email OTP, phone OTP, or magic-link verification before the agent proceeds past a sensitive step. The workflow resumes with a confirmed identity context.
Human Approval — Sign-Off Before Execute
Pause the agent and route an approval request to a human reviewer. Approve, reject, or send feedback from the dashboard or mobile app. Every decision logged for audit.
Every tool call passes through scopes + guardrails before reaching your infra. Human approval intercepts irreversible actions.
Per-tool allow/deny.
Least-privilege for every agent.
MCP security starts with scope control. For every bot you deploy, mcp_scopes defines the exact tools that agent is permitted to call. Install a full Postgres MCP and only expose read_table and run_query. Block drop_table and delete_rows entirely.
When the agent calls a blocked tool, the request is rejected before it reaches the MCP server — not after. This is enforcement at the permission layer, not the prompt layer. Prompts can be manipulated; MCP scopes cannot.
{
"name": "Analytics Bot",
"mcp_scopes": {
"postgres": [
"read_table",
"run_query",
"list_tables"
],
"github": [
"list_repos",
"read_file",
"create_issue"
]
}
}
Block PII, injection, and off-topic output.
Agent guardrails, enforced in the graph.
The guardrail node is the LLM security layer inside your workflow. It runs composable safety checks on agent I/O before anything is acted upon — enabling you to secure AI agents at runtime, not just at configuration time. Enable only what you need. Every check routes to a pass or blocked edge.
pii_detection PII Detection
Detects and redacts personal information — emails, phone numbers, SSNs, credit card numbers — before the agent outputs them or logs them downstream.
regex_blocklist Regex Blocklist
Define banned words, phrases, or patterns. The check runs client-side with zero LLM cost — word-boundary regex matches before any expensive call fires.
prompt_injection Prompt Injection
Heuristic scan for prompt injection attempts — instructions embedded in user input designed to override your system prompt or escalate privilege.
output_length Output Length Cap
Hard limit on agent response length in characters. Prevents runaway generation, cost blowouts, and downstream overflow issues.
cost_budget Cost Budget
Accumulates token spend across nodes. If the conversation budget (in cents) is exceeded, the guardrail routes to blocked — the agent cannot run more LLM calls.
topic_scope Topic Scope
LLM-backed check: restrict the agent to configured topics. An HR bot stays on HR questions. A support bot stays on product support. Off-topic queries are blocked.
content_policy Content Policy
LLM-backed moderation check on output. Catches harmful, illegal, or policy-violating content before it reaches your users or downstream systems.
Guardrail routing
Verify who the agent is acting for.
Then require a human to confirm.
Two security primitives that work at the execution level — not the prompt level. Every sensitive action can be gated by identity and gated by a human decision before it runs.
Auth Gate
Verify identity before sensitive steps
Place an auth gate node anywhere in your workflow to require identity verification before the agent proceeds. Supports email OTP, phone OTP, and magic link. The agent pauses, the user verifies, and the workflow resumes with a confirmed identity context.
Use before
Human Approval
Block irreversible actions until signed off
The human approval node pauses the agent and routes the decision to a reviewer — via the Aerostack dashboard or the OpenClaw mobile app. The reviewer approves, rejects, or sends feedback and lets the agent revise. Every decision is timestamped and logged for audit.
Use before
LLM security: advisory vs. enforced — the difference that matters
OWASP LLM Top 10, NIST AI RMF, and most vendor LLM security guides tell you what to implement: least-privilege access, input validation, output filtering, human oversight. They are advisory. Aerostack ships the enforcement layer: MCP scopes enforce least-privilege at the tool call, the guardrail node runs input/output checks in the execution graph, auth gates verify identity in-flow, and human approval nodes hold irreversible actions until a person signs off. The controls are in your workflow — not in a document. This is what it means to secure AI agents in production, not just describe how to.
Nobody else is doing this.
Compare MCP security and agent guardrails across platforms. Aerostack is the only platform with both tool-level permission control and enforced runtime guardrails.
Safe agents for every team.
Data Teams
Give AI agents read-only database access for analytics and reporting. Block all writes. No more "I accidentally dropped the table" incidents.
Engineering Teams
Let agents read code, create PRs, and review diffs — but block force pushes, repo deletion, and branch protection changes.
Support Teams
Agents can read customer tickets and search knowledge bases. Block sending messages to prevent AI from responding without human review.
DevOps Teams
Monitor infrastructure with AI — describe instances, read metrics, check logs. Block terminate, delete, and any destructive cloud operations.
Compliance Teams
Meet SOC 2 and GDPR least-privilege requirements. Every tool call audited. Permission changes tracked. Export-ready compliance reports.
Agency & Freelancers
Give clients AI-powered dashboards without worrying about agents breaking things. Set permissions per client workspace.
Stop giving agents
the keys to everything.
Set up tool-level permissions in under 5 minutes. Free to start. Your databases, repos, and APIs will thank you.
Related features