// SETUP
From at risk to enforced in 30 seconds.
Run one command. PolicyLayer finds your MCP servers, scans every tool, and opens a web UI to assign policies.
One enforcement layer across every MCP server. Every action is allowed, blocked, or approved before it executes.
npx -y @policylayer/intercept init PolicyLayer enforces it at the boundary — a transparent proxy between your agent and every MCP server. Same tools, same schemas, every call evaluated before it executes.
Run one command. PolicyLayer finds your MCP servers, scans every tool, and opens a web UI to assign policies.
Readable, version-controlled, and hot-reloaded — update rules without restarting anything.
version: "1" default: deny tools: transfer_funds: rules: - spend_limit: $500/day terminate_instances: rules: - action: require_approval approval_timeout: 10m execute_query: rules: - conditions: - path: "args.query" op: "regex" value: "^SELECT" create_deployment: rules: - rate_limit: 5/day hide: - drop_database - delete_repository
New tools added upstream don't automatically reach the agent. You opt in, not out.
Push a policy change without restarting. Useful when you're tightening limits mid-incident.
Policy validation catches errors before deployment. No silent misconfigs.
Prevent duplicate actions from agent retries. Same call within the window skips re-evaluation.
Stdio and HTTP. Works with local MCP servers and remote endpoints.
Hold sensitive actions for human approval. One-time use, fingerprinted, audited, with optional webhook notifications.
Cap cumulative spend per agent, per tool, or per day. When agents pay via MCP, this is the hard limit between the agent and real money.
Rate limits, spend counters, and approval records persist across restarts. SQLite by default. Redis for multi-instance deployments.
Evaluate every call without enforcing. See what would have been blocked before you go live.
Pre-classified tools across 18,000+ endpoints. Know what's dangerous before your agent does.
12 write · 3 destructive · 12 read
22 write · 8 destructive · 25 read
14 write · 5 destructive · 13 read
15 write · 4 destructive · 15 read
28 write · 6 destructive · 28 read
4 write · 3 destructive · 5 read
An open-source MCP enforcement proxy that controls every tool call before it executes. It sits between your agent and the MCP server. You define rules in YAML — what to block, rate limit, cap, or hold for approval. One line change in your MCP config. No agent modifications.
Any MCP server, including third-party ones you don't control. Stripe, AWS, Postgres, GitHub, Supabase, PagerDuty — if it speaks MCP, PolicyLayer can sit in front of it. The policy library has starter templates for 3,000+ servers.
No. One line change in your MCP config. The agent sees the same tools and the same schemas. PolicyLayer is transparent — it only becomes visible when a rule fires.
Prompts tell the agent what it should do. PolicyLayer defines what it is allowed to do. You can't cap spend with a prompt. You can't make a tool genuinely read-only with a prompt. Either the call is within policy or it isn't. Deterministic, not probabilistic.
Yes. PolicyLayer is fully open source under the Apache 2.0 licence. Single Go binary, no dependencies, no vendor lock-in. Run it anywhere.
PolicyLayer governs tool calls that pass through the proxy. It does not govern direct API calls outside the MCP path, model reasoning, or actions taken by tools after they receive the forwarded call. If traffic bypasses the proxy, PolicyLayer has no visibility.
Set budgets, approvals, and hard limits across MCP servers.
npx -y @policylayer/intercept init