mcp.enforceModule 04Put a front on an MCP server so each tool call is admitted like any other intent, and a refused call never reaches the server.
mcp.enforce asks Intralock whether an agent may call an MCP tool and returns a verdict, with no model in the path. The same gateway can also forward a call to a registered upstream under the workspace's mode: observe records, advise reports, enforce refuses.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abusemcp/enforce returns allow or refuse and forwards nothing. To have the gateway admit, strip, forward and screen a call, register an upstream with upstream-add and send the call to mcp/call.
Plane module
actorDidtoolresource is sent.resource/docs/mcp-enforceAPI referenceRoutes, bodies and status codes./docs/mcp-enforceOpen the consoleSee the module at work in the dashboard, on a seeded fleet or your own./app/enforcementStart freeCreate a workspace and admit your first intent./auth/signup
actionfs.write, admits as write whatever you send. Only delete is kept.confirmationTokenallowreasonquarantine or a missing grant.llmfalse. The verdict comes from a pure function.protocolVersionThe default. call forwards with no admission check and notes the call as observed. The workspace's shadow log fills with what agents would have done.
call admits the intent and reports what the plane would have said, such as would be refused, but forwards anyway. Declared transforms still apply.
call admits the intent and forwards only if allowed. A refused call returns forwarded: false and never leaves the gateway.
mode takes observe, advise or enforce and stores it for the workspace. Start in observe and read shadow before you switch.
upstream-add names an MCP server by URL, with an optional connection credential or a mapping pack that classifies its tools.
call takes , , and . The gateway derives the action and resource, admits the intent and forwards on allow.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private. mcp.enforce docs
Press Run to send the request on the left to the shared demo workspace.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private.
A request in the shape the API accepts, and an example response in the shape the module returns.
POST /api/v1/acp/mcp/enforce Authorization: Bearer av_workspace_•••• Content-Type: application/json { "actorDid": "did:web:acme.example:agent:support", "tool": "fs.write" } → 200 { allow, reason, action, llm }
{
"mode": "observe",
"shadow": false,
"event": {
"actorDid": "did:web:acme.example:agent:support",
"tool": "fs.write"
},
"advise": null,
"allow": false,
"reason": "no_grant",
"action": "write",
"llm": false,
"protocolVersion": "2026-07-28"
}A tool named bash or fs.write admits as a write, so it needs a grant and, under the confirmation floor, a human approval before it runs.
Run in observe for a week. shadow lists the last 50 calls the plane saw, so you can see which would have been refused.
call screens the upstream's reply, defangs instruction-shaped text and sets instructionShaped in provenance, so a tool result cannot pose as an instruction.
In advise and enforce, call removes command and shell from the arguments and lists the removed names in stripped.
coordination.admit; the gateway calls it for you.coordination.approve; the gateway only returns the approvalId.github.enforce, which admits repo: resources and posts the result back to GitHub.A module is a strong claim about a narrow thing. Rely on it for exactly what it is.
enforce runs Intralock admission whatever mode is stored, so the verdict is the same pure-function answer as coordination.admit.enforce mode a refused call is not forwarded: the response says forwarded: false and no request goes upstream.mcp.shadow event, and every call an mcp.call event, to the ledger.read or call by the request.instructionShaped flag are heuristics on text, not a guarantee.mode is the mode used. On enforce it reports the stored mode, which may be observe, though the verdict is always Intralock's.enforce returns the shadow row with shadow: false, plus allow, reason, the admitted action, llm: false and protocolVersion.
A write without a token comes back from call with allow: false and an approvalId. The enforce route returns only allow and reason.
An upstream can carry a mapping pack that names each tool's action and resource. A mapped tool admits against its resource instead of the default.
mode, upstream-add and upstream-remove need policies.approve. enforce, call and shadow carry no permission of their own, so the admission verdict is the control.
call times out an upstream at 8000 ms and refuses a reply larger than 1 MiB.shadow returns the last 50 events.enforce without actorDid or tool returns 400, and call without upstream does too.Authenticate with a workspace API key as a Bearer token. The base URL is https://api.intramedial.com.
/api/v1/acp/mcp/enforceAdmit a tool call and return the verdict; forwards nothing./api/v1/acp/mcp/callAdmit, strip, forward and screen a call through an upstream./api/v1/acp/mcp/modeSet the workspace's gateway mode./api/v1/acp/mcp/shadowList the last 50 observed events./api/v1/acp/mcp/upstream-addRegister an upstream MCP server.coordination.mcp.enforceAsk for a verdict from an agent.coordination.mcp.modeSet the mode from an agent.coordination.mcp.shadowRead the shadow log from an agent.coordination.admit01Intralock admissionDecide every action before it happens: an agent declares its intent, and Intralock admits it or names the reason it may not.mcp.shadow13Shadow agent discoveryList the tool calls the MCP gateway has seen, with the agent behind each, so callers nobody enrolled show up beside the ones that are.coordination.approve05Human approval queueHold a risky write or delete until a signed-in person approves it, with the agent, resource and verb in front of them.github.enforce29GitHub write gateMake a commit's check go red unless the agent behind it holds the grant and, for a write, a human has confirmed.saas.admit30SaaS connector admissionAsk whether an agent may touch a SaaS source, and let it write through one only after the same check that gates everything else.iam.assume31Cloud credential brokerGive an agent a short-lived cloud credential only while it holds a live lease on the role, and let the credential die with the lease.actorDidupstreamtoolargsenforce takes actorDid and tool and answers allow and reason from Intralock. Use it when your own code makes the call.
coordination.halt06