Create your account

Specify Work · Security · Any MCP client

Security for any MCP client.

Create your accountSecurity, the overview

The adapter’s proxy wraps each MCP server a client is configured with. Every tool call passes the same policy, tool descriptions are checked for drift, and secrets are redacted on the way back.

A denial in Any MCP client

MCP proxy · J. Okafor · deploy server
  1. Roll release 24.3 out to production.
  2. mcp__deploy__run { "env": "production", "version": "24.3" }
  3. Denied by Specify · Production changes · logged as d_4f81
  4. Production deploys need an exception from your org admin. Ask from the record, or run: specify escalate d_4f81
  5. Skipping the rollout. Continuing with the release notes.
  6. Four hours later, after D. Marsh grants the exception
  7. mcp__deploy__run { "env": "production", "version": "24.3" }
  8. Allowed by exception e_812 · D. Marsh · once · logged

  1. The proxied call

    The client talks to the proxy; the proxy talks to the server. A denied call returns the policy and the reason as the tool’s result, so the agent moves on.

  2. The escalation id

    Every denial prints its id and the one command that escalates it. The person can do the same from the record, and a retry before approval is denied again and counted.

  3. Descriptions, checked

    The proxy reads every tool description on connect and again whenever it changes, and flags a server whose tools start saying something new.

One command on each machine.

$ specify adapter install mcp

Run it once per machine. It enrols the person, starts the adapter and rewrites the client’s MCP configuration so each server runs behind the proxy:

  • Each server entry now starts specify-mcp with the original command behind it
  • Tool descriptions are read on connect and on change
  • Results pass the secret redactor before the client sees them
  • The server list and its tools report to inventory
# mcp.json, after install
{ "mcpServers": { "deploy": {
    "command": "specify-mcp",
    "args": ["--", "npx", "deploy-mcp-server"]
} } }

What is checked in Any MCP client.

  • MCP tool calls — covered

    Every call on every wrapped server, by server and tool name.

  • Tool descriptions — covered

    Read on connect and on change; drift is flagged on the record.

  • Results — covered

    Secrets are redacted before the client sees them.

  • Shell commands — not covered

    The proxy sees only calls to servers. A client’s own shell is covered by that client’s adapter, where it has one.

  • File edits and reads — not covered

    Same again: the client’s own file tools do not pass through the proxy.

  • Subagents — not covered

    The proxy sees the call, not which part of the client made it.

  • IdentitySigns in once

    The person signs in once on the machine; every event names them from then on.

What the org can pin

There is no hook to pin. The org lists the servers it allows in policy, and the proxy denies the rest.

# policy: mcp servers
allow  mcp__memory__*
allow  mcp__deploy__*
deny   mcp__*          # anything not listed
  • A server the org has not listed is denied by the proxy and shows on the posture list.
  • The client’s own shell and file tools are outside the proxy. The coverage table says so, per client.

When something is missing

If the proxy does not answer
The call fails, and the client shows the tool as failed. The adapter decides from the cached bundle on the machine, so an answer never depends on the network.
If the adapter is not running
The proxy answers from the last signed bundle: flagged tools are denied, everything else is allowed, and an adapter-down event is logged.
If the person edits the configuration back
The server runs unwrapped and inventory shows it. The coverage list shows it as not covered until the proxy is back in front of it.

The other clients

Hold the line without slowing the team.

Standard policies come with every plan. Your own policies, simulation and exceptions come with Org.

See pricing