Set budgets, approvals, and hard limits across MCP servers. So your agent can do its job without breaking things.
npx -y @policylayer/intercept Intercept is a transparent proxy between your agent and the MCP server. Same tools, same schemas — every call evaluated before it executes.
Readable, version-controlled, and hot-reloaded — update rules without restarting anything.
version: "1" default: deny tools: transfer_funds: rules: - spend_limit: $500/day terminate_instances: rules: - action: require_approval approval_timeout: 10m execute_query: rules: - conditions: - path: "args.query" op: "regex" value: "^SELECT" create_deployment: rules: - rate_limit: 5/day hide: - drop_database - delete_repository
New tools added upstream don't automatically reach the agent. You opt in, not out.
Push a policy change without restarting. Useful when you're tightening limits mid-incident.
intercept validate catches policy errors before deployment. No silent misconfigs.
Prevent duplicate actions from agent retries. Same call within the window skips re-evaluation.
Stdio and HTTP. Works with local MCP servers and remote endpoints.
Hold sensitive actions for human approval. One-time use, fingerprinted, audited, with optional webhook notifications.
Cap cumulative spend per agent, per tool, or per day. When agents pay via MCP, this is the hard limit between the agent and real money.
Rate limits, spend counters, and approval records persist across restarts. SQLite by default. Redis for multi-instance deployments.
Evaluate every call without enforcing. See what would have been blocked before you go live.
Pre-classified tools across 18,000+ endpoints. Know what's dangerous before your agent does.
12 write · 3 destructive · 12 read
22 write · 8 destructive · 25 read
14 write · 5 destructive · 13 read
15 write · 4 destructive · 15 read
28 write · 6 destructive · 28 read
4 write · 3 destructive · 5 read
An open-source MCP gateway that controls every tool call before it executes. It sits between your agent and the MCP server as a transparent proxy. You define rules in YAML — what to block, rate limit, cap, or hold for approval. One line change in your MCP config. No agent modifications.
Any MCP server, including third-party ones you don't control. Stripe, AWS, Postgres, GitHub, Supabase, PagerDuty — if it speaks MCP, Intercept can sit in front of it. The policy library has starter templates for 3,000+ servers.
No. One line change in your MCP config. The agent sees the same tools and the same schemas. Intercept is transparent — it only becomes visible when a rule fires.
Prompts tell the agent what it should do. Intercept defines what it is allowed to do. You can't cap spend with a prompt. You can't make a tool genuinely read-only with a prompt. With Intercept, either the call is within policy or it isn't. Deterministic, not probabilistic.
Yes. Intercept is fully open source under the Apache 2.0 licence. Single Go binary, no dependencies, no vendor lock-in. Run it anywhere.
Intercept governs tool calls that pass through the proxy. It does not govern direct API calls outside the MCP path, model reasoning, or actions taken by tools after they receive the forwarded call. If traffic bypasses the proxy, Intercept has no visibility.
Set budgets, approvals, and hard limits across MCP servers.
See what your agent can donpx -y @policylayer/intercept