MCP Boundary

MCP Boundary is a local checkpoint between your AI agent - for example Claude Desktop - and the MCP tools it uses. You write the rules; Boundary checks each routed call against them before it runs. Nothing here is automatic - it does what your policy says. The point is not just to say no. When Boundary blocks a call, it sends back a short, machine-readable reason the agent can use, so the agent can adjust the request instead of failing or retrying blindly. Two things make that useful. State-aware writes. One rule you can set is to tie a write to the data the agent read first. Then, if that data changed in the meantime, Boundary stops the write and tells the agent to read again before acting. A valid call is not always a safe outcome. Clear feedback, and human approval when it matters. A block is not a dead end. The reason can be specific - for example, which email recipients were rejected, so the agent can retry without them. And for a call that needs a person's OK, nothing runs: the agent gets a clear "waiting for approval" answer and pauses, while a human approves or rejects the exact action in the local dashboard. Only an approved follow-up call goes through. Your rules can reach into the details of a call, not just its name: which recipients are allowed, which values are permitted, how much data can come back, how often a call may repeat. Every checked call - the decision, the reason, the result - lands in a local activity view, so you can see what the agent tried and why it was allowed or blocked. It all runs on your machine. The agent sees the tools, never the passwords or tokens behind them, and nothing is sent back to us. About prompt injection: Boundary does not try to detect a jailbreak or a poisoned instruction. It works one layer lower. Even if the model is tricked, routed calls can still only do what your policy allows - so a risky send, write, or delete that your policy blocks stays blocked, or waits for a human, no matter why the agent asked. Honest scope: Boundary only checks calls that actually run through it. It does not vouch for what an MCP server does inside, and it is a local tool for developers and operators — not a hosted security gateway or a data-loss filter.