Enterprise Security for Model Context Protocol (MCP): Tool Governance & Isolation

Specification & Architecture • Updated: 26 Oct 2026 • Plain text / Markdown

Model Context Protocol (MCP) standardizes how LLM agents discover and invoke external tools, but lacks native enterprise security primitives. Axiom provides the governed enterprise MCP gateway—enforcing zero-trust tool access, parameter-level bounds, spend rate ceilings, and bidirectional prompt injection sanitization on all MCP client-server exchanges.

The Model Context Protocol (MCP) Security Blind Spot

Anthropic's Model Context Protocol (MCP) has rapidly emerged as the open industry standard for connecting LLM applications to external tools, databases, and third-party APIs. However, standard MCP architecture assumes a benign, trusted execution environment. In production enterprise deployments, this assumption breaks down across three vectors:

Unconstrained Tool Discovery: Agents automatically discover all exposed MCP tools, allowing a conversational model to call high-risk operational tools (e.g. delete_customer_record or transfer_funds) without granular role-based authorization.
Bidirectional Prompt Injection: Untrusted external data returned by an MCP resource server (e.g. an email body or web page) can contain adversarial prompt injection instructions that hijack subsequent tool calls.
Unbounded Cost & Transaction Caps: MCP specifies tool schemas but provides no native mechanisms to enforce cumulative budget caps or transaction limits per agent session.

Axiom MCP Security Architecture: Zero-Trust Gateway

Axiom acts as a transparent, security-enforcing reverse proxy between your MCP client (Claude Desktop, Cursor, LangChain, Custom Agent Runtime) and downstream MCP servers.

policy.yamlAxiom Declarative Security Spec

# /etc/axiom/policies/erp-agent.yaml
version: "2026-10-auth"
agent_role: "procurement_assistant"
mcp_servers:
  - server: "sap-finance-mcp"
    tools:
      - name: "match_invoice_to_po"
        allow: true
        constraints:
          max_discrepancy_cents: 5000  # Max $50 auto-reconciliation
      - name: "approve_vendor_payment"
        allow: true
        rate_limit: "5/minute"
        ceiling:
          single_transaction_max: 5000000 # $50,000 threshold
          action_on_exceed: "escalate_to_human"
          escalation_channel: "slack:#finance-approvals"
      - name: "alter_vendor_banking_details"
        allow: false # Completely blocked from autonomous agent access

Four Layers of MCP Defense-in-Depth

Table 1: Four Security Control Layers Enforced by Axiom on MCP Protocols
Security Layer	Vulnerability Mitigated	Enforcement Mechanism	Failure Behavior
1. Tool Discovery Masking	Unauthorized tool invocation / over-privilege	Dynamic filtering of MCP `tools/list` response based on agent IAM token	Tool not visible to model
2. Strict Schema Invariants	Parameter hallucination & type injection	Sub-1ms JSON schema validation; rejects coercion and undeclared attributes	Immediate 422 Client Error
3. Spend & State Ceilings	Financial runaway & bulk deletion loops	Task-scoped state accumulator; enforces per-call and cumulative monetary bounds	Pauses execution for Human Sign-off
4. Payload Sanitization	Indirect prompt injection via MCP resources	Parses raw tool responses, strips markdown/HTML executable escapes and instruction triggers	Sanitized text returned to context

Cryptographic Audit Trail for Compliance

Enterprise compliance frameworks (SOC 2 Type II, ISO 27001, HIPAA) require verifiable auditability for automated actions. Every tool invocation routed through Axiom generates an immutable log entry containing:

The exact agent prompt context and model version that initiated the call.
Full validated input parameters and execution timestamp.
Upstream MCP server response payload and latency.
HMAC-SHA256 signature linking the transaction to the customer's KMS key.

Frequently Asked Questions

Does Axiom slow down MCP tool execution?

No. Axiom is engineered in high-performance Go/Rust. Average latency overhead for full schema verification, ceiling arbitration, and audit logging is between 3.8ms and 7.2ms—well below the 500ms+ network latency of LLM inference.

Can Axiom prevent indirect prompt injection in MCP tools?

Yes. Axiom inspects data returned from downstream MCP servers (e.g. database rows, scraped web pages, support tickets) and sanitizes adversarial prompt injection tags before returning the payload to the LLM agent reasoning loop.

What happens when an agent exceeds an MCP spend limit?

Rather than failing catastrophically and crashing the workflow, Axiom pauses the task and issues an asynchronous Human-in-the-Loop review request via webhook, email, or Slack. Once approved by an authorized manager, execution resumes seamlessly.

Is Axiom compatible with Claude Desktop and Cursor?

Yes. Axiom acts as a standard MCP proxy endpoint. You can configure Claude Desktop or Cursor to point directly to Axiom as an MCP server.

Deploy Governed Tools for Your AI Agents

Axiom deploys inside your VPC with native Model Context Protocol (MCP) support and deterministic spend ceilings. Book a 20-minute architecture review.

Request Architecture Review Read Full Specs