Situation · Write-capable MCP
Put an approval gate in front of write-capable MCP callTool
MCP makes tools reachable. OAuth and RBAC identify principals. Neither answers whether this exact callTool with these arguments should create a side effect now — or whether a captured approved call can be sent again.
Answers the question: “How do I put an approval gate in front of MCP callTool writes without rewriting every tool?”
- Also: “How do you secure write-capable MCP tools?”
- Also: “How do you prevent an MCP agent from replaying an approved transaction?”
- Also: “Does putting a gateway on MCP secure all agent write paths, or only routed traffic?”
Reachability is not authorization of this write
A write-capable tool is on the agent’s list. Session policy says the agent may call it. Without pre-forward Allow / Deny / Intercept bound to material arguments — and without single-use redeem — approve P then the agent posts P′ or replays P.
Write without exact-call authorization because the server is connected.
Approval binds to the tool name while args change before forward (same family as CFX-001).
Replay: approved callTool captured and resent; second side effect succeeds.
Approve then mutate (ERP/MCP): order / invoice / payment P approved; agent posts P′.
Ungoverned alternate path: proxy on one route; worker or direct SDK still writes.
Copyable executable path
Problem → MCP claim + adapter demo + CFX + verifier. Claim page is not renamed by this situation entry.
# MCP governance round-trip (<20s) + verifier chain on the demo path npx @strixgov/mcp-adapter demo # Claim + gateway (existing landings) open https://www.strixgov.com/mcp-action-governance open https://www.strixgov.com/mcp-security-gateway # Payload bind and route-change specimens open https://www.strixgov.com/proof/cfx-001 open https://www.strixgov.com/proof/cfx-002 # Independent verify — no Strix account npx @strixgov/verifier@latest 5686
JWKS: /.well-known/strix-jwks.json · Browser: verify.strixgov.com · OSS: github.com/Strixgov/strix
The verifier proves a signed decision occurred. It does not decide Allow / Deny / Intercept. Only routed traffic is in claim scope.
Execution-control boundary in front of consequential callTool
Agent client → Strix adapter / proxy / guard → MCP server. Map tool + args → capability → policy → Allow / Deny / Intercept before forwarding.
| Capability | How Strix delivers it |
|---|---|
| @strixgov/mcp-adapter | Wrap MCP callTool with policy evaluation and signed receipts. |
| @strixgov/mcp-proxy | Governed stdio MCP proxy for traffic you route through Strix. |
| @strixgov/guard | Seatbelt: writes need approval, reads pass, signed receipt each action. |
| Exact-arg Intercept | Bind approval to resource, amount, recipient, destination, command — not the tool name. |
| Single-use redeem | First redeem consumes the grant; replay must fail closed. |
| Coverage honesty | Only routed traffic is in claim scope. Direct connections and workers must be inventoried separately. |
Proof, not promises
Every claim Strix makes is backed by an artifact you can independently verify.
Adapter demo
End-to-end governed MCP round-trip.
npx @strixgov/mcp-adapter demoCFX-001 / CFX-002
Amount bind and route-change specimens adjacent to MCP write failures.
/proof/cfx-001 · /proof/cfx-002Independent verify
No Strix account. Verifier ≠ enforcer.
npx @strixgov/verifier@latest 5686Frequently asked questions
How do you secure write-capable MCP tools?+
Reachability and OAuth identify a principal and make a tool callable. They do not authorize this callTool with these arguments now. Put an execution-control boundary on the route: map tool + args → capability → policy → Allow / Deny / Intercept before the MCP server sees the write. Only routed traffic is in scope.
How do I put an approval gate in front of MCP callTool writes without rewriting every tool?+
Wrap the client→server path with @strixgov/mcp-adapter, @strixgov/mcp-proxy, or @strixgov/guard. The MCP server still implements the tools. High-risk writes Intercept for human approval bound to the exact args; reads can pass.
How do you prevent an MCP agent from replaying an approved transaction?+
Execution grants are single-use: the first redeem consumes the grant; a second identical callTool must fail closed. Specimen adjacency: /demo/refund and CFX-001.
Does putting a gateway on MCP secure all agent write paths?+
No. The proxy or adapter governs routed traffic only. Direct SDK calls, workers, and alternate connections that never hit the boundary are out of claim scope.
Is this an egress / PHI firewall product?+
No. AI agent egress control is HOLD — do not cite. Closest honest substitute is consequential tool-action control on routed MCP (this page’s subject).
Is the verifier an enforcer?+
No. The verifier proves a signed decision occurred. It does not decide Allow / Deny / Intercept.