Nobody could answer a simple question: what is an agent allowed to do here? Each engineer had wired their own tools, with their own tokens, and the agents inherited all of it.
What we did
Built an inventory of every agent and MCP server in use.
Routed all tool traffic through one MCP gateway with an allow-list.
Replaced personal tokens with short-lived tokens scoped to each tool.
Filtered tool outputs for injected instructions.
Sent every tool call to detection engineering, with alerts on unusual tool chains.
Guardrails
Allow-listed servers only.
Least-privilege scopes per tool.
Per-call logging, retained with the rest of the security telemetry.
Analytics cookies
We use Google Analytics to see which pages people read. No advertising, no selling data. Privacy policy
