Security for any MCP client

The adapter’s proxy wraps each MCP server a client uses, so every tool call passes the same policy.

A denial in Any MCP client

Roll release 24.3 out to production.
mcp__deploy__run { "env": "production", "version": "24.3" }
Denied by Specify · Production rollouts, your org’s rule · logged as d_4f81
Deploys need an exception from your org admin. Ask for one from the record.
Skipping the rollout. Continuing with the release notes.
Four hours later, after your org admin grants the exception
mcp__deploy__run { "env": "production", "version": "24.3" }
Allowed by exception e_812 · your org admin · once · logged

The proxied call: The client talks to the proxy; the proxy talks to the server. A denied call returns the policy and the reason as the tool’s result, so the agent moves on.
The escalation id: Every denial carries its id, and the person asks for an exception from the record. A retry before approval is denied again.
Descriptions, checked: The proxy reads every tool description on connect and again whenever it changes, and flags a server whose tools start saying something new.

One command on each machine

Run it once per machine. It enrols the person, starts the adapter and rewrites the client’s MCP configuration so each server runs behind the proxy:

$ specify adapter install mcp

Each server entry now starts specify-mcp with the original command behind it
Tool descriptions are read on connect and on change
Results pass the secret redactor before the client sees them
The server list and its tools report to inventory

# mcp.json, after install
{ "mcpServers": { "deploy": {
    "command": "specify-mcp",
    "args": ["--", "npx", "deploy-mcp-server"]
} } }

What is checked in Any MCP client

MCP tool callsChecked: Every call on every wrapped server, by server and tool name.
Tool descriptionsChecked: Read on connect and on change; drift is flagged on the record.
ResultsChecked: Secrets are redacted before the client sees them.
Shell commandsNot checked: The proxy sees only calls to servers. A client’s own shell is covered by that client’s adapter, where it has one.
File edits and readsNot checked: Same again: the client’s own file tools do not pass through the proxy.
SubagentsNot checked: The proxy sees the call, not which part of the client made it.
IdentitySigns in once: The person signs in once on the machine; every event names them from then on.

What the org can pin

There is no hook to pin. The org lists the servers it allows in policy, and the proxy denies the rest.

# policy: mcp servers
allow  mcp__memory__*
allow  mcp__deploy__*
deny   mcp__deploy__run  # production rollouts, until an exception
deny   mcp__*            # anything not listed

A server the org has not listed is denied by the proxy and shows on the posture list.
The client’s own shell and file tools are outside the proxy. The coverage table says so, per client.

When something is missing

If the proxy does not answer: The call fails, and the client shows the tool as failed. The adapter decides from the cached bundle on the machine, so an answer never depends on the network.
If the adapter is not running: The proxy answers from the last signed bundle: flagged tools are denied, everything else is allowed, and an adapter-down event is logged.
If the person edits the configuration back: The server runs unwrapped and inventory shows it. The coverage list shows it as not covered until the proxy is back in front of it.