File systems, APIs, databases — MCP connects them all directly to the model. Nothing stops a tool call from running automatically. One misconfigured prompt can lead to data deletion, unauthorized access, or runaway API calls.
Intercept every MCP tool call and enforce policies per action type. Block dangerous operations, require approval for sensitive actions, and log everything for compliance.
import { Shield } from "@runplane/runplane-sdk";
const runplane = new Shield({
apiKey: process.env.RUNPLANE_API_KEY
});
// Before executing any MCP tool call
const result = await runplane.guard(
"execute_mcp_tool",
"mcp-server",
{ tool: toolName, args: toolArgs },
async () => mcpServer.executeTool(toolName, toolArgs)
);
// Handle the result
if (result.decision === "BLOCKED") {
return { error: "Action blocked by policy" };
}
return result.output;Enforce policies per MCP server
Block file system and database access
Require approval for API mutations
guard() intercepts the action before execution
Policy engine evaluates and returns a decision
Action runs, blocks, or waits for approval
File System
Database
Git Operations
External APIs