Neural Inverse Govern / MCP
Only reviewed MCP servers and approved tools reach your agents.
A catalog of MCP servers reviewed tool by tool, assigned to the organisation, teams or projects, delivered as a signed manifest and called through a gateway that holds the credentials.
- Servers
- Remote and local, reviewed per tool
- Assignment
- Deny by default, deny wins
- Credentials
- Encrypted in Govern's vault
- Delivery
- Ed25519-signed manifest
- Coding tools
- Local MCP proxy on enrolled devices
Overview
MCP is how AI agents reach tools and data. Govern holds the approved catalog of MCP servers: who added each one, which tools a reviewer allowed, which are read or write and which need a person's approval for each call. Remote servers are called through Govern's MCP gateway, which checks every call, injects the credential and records the decision. On developer machines, a local proxy applies the same catalog and your agent policy to the MCP servers that coding tools start themselves.
What it does
What MCP governance covers.
Which servers and tools exist, who may use them, with which credentials, and what happened on each call.
Server catalogRemote servers, which Govern proxies, and local servers, which the client runs from a pinned package with an exact version and digest. Start from a list of starter servers or add your own.
Tool discoveryGovern lists a remote server's tools itself. For a local server, an administrator uploads the tool list a client produced; Govern never runs packages.
Review per toolA reviewer approves or rejects the server and decides each tool: allowed or blocked, read or write, and whether each call needs approval. The person who submitted a server cannot review it unless you allow self-review.
Changed tools go back to reviewEach tool's definition, description included, is hashed. A new or changed tool waits as pending, and a server whose tools changed is marked changed until a reviewer looks again. Editing what a server runs sends it back to draft.
AssignmentsAllow, require or deny a server for the organisation, a team or a project. A deny wins; required servers are installed and cannot be turned off.
Classification ceilingEach server is cleared up to a data classification. A server cleared for internal is never delivered to a confidential project, and raising its ceiling sends it back to review.
CredentialsAn organisation-held key or OAuth client per server, or each person's own connection by API key or OAuth with PKCE. Values are encrypted in Govern's vault, bound to the organisation, server, person and field, and never returned.
MCP gatewayPeople call remote servers through Govern with their own sign-in, never seeing the upstream address or its credentials. Only tool calls are forwarded; the server's own instructions are dropped because no reviewer approved them.
DLP on arguments and resultsArguments, results and upstream errors are scanned at the request's classification: redacted at public and internal, removed or refused above that and in regulated projects.
Call approvalsA write tool marked for approval waits for a person with MCP approval rights, never the caller, who sees the checked arguments. The approved call goes through once.
LimitsRate limits per person and server and per server for the organisation, and size limits on arguments and results.
Signed manifestEach person receives an Ed25519-signed list of their servers and callable tools for a project, with an expiry you set for offline use. Local servers include their tool lists, so clients can enforce them too.
Enforcement on developer machinesOn an enrolled device, a local MCP proxy decides every server start and tool call of the AI coding tools against the signed catalog and your agent policy's MCP rules. A refused call never reaches the server, and refused tools are left out of the tool list.
Configuration injectionThe proxy is written into the MCP configuration of Claude Code, Cursor, Windsurf, VS Code, Gemini CLI, Codex, Cline, Roo Code, Zed, Copilot CLI, Amazon Q and other tools, keeping a byte-identical restore. Remote entries named after a catalog server are pointed at the gateway.
Drift reportsClients report tool lists of local servers that differ from the reviewed list, and devices report the mode their proxy runs in.
Call activityEvery gateway and proxy decision with caller, server, tool, outcome, reason, latency, DLP findings and the approval behind it. Content is stored only if you turn it on, for a retention you set.
The gateway forwards tools only: MCP resources and prompts are not passed through. Govern cannot verify which package a local client really runs; the digest check and local tool blocking happen on the device, so a reviewer must read a local server's command and arguments. The proxy runs as the developer; managed settings keep it in place.
How it works
From a new server to a recorded tool call.
- AddAdd a starter or custom server as a draft with no usable tools.
- DiscoverGovern lists the remote server's tools, or you upload a local server's list.
- ReviewSomeone other than the submitter approves each tool, read or write, with or without call approval.
- AssignAllow, require or deny the server for the organisation, teams or projects.
- DeliverClients and the device proxy receive the signed manifest of callable servers and tools.
- CallThe gateway or the proxy decides each call, and the decision is recorded.
Who uses it
Built for every role that answers for AI.
Platform and AI teamsAdd servers, run discovery, set credentials and assign servers to teams and projects.
Security reviewersReview servers and tools, decide which writes need approval, and set classification ceilings.
ApproversDecide write tool calls that wait for a person, seeing the checked arguments.
EngineersConnect their own account to servers that need it, and use the tools assigned to them in their coding tools.
Enforced and recorded
Decided on every call, recorded with it.
Remote tool calls are decided by the MCP gateway on the server. Local servers are decided by the proxy on enrolled devices.
Enforced
People only at the gatewayThe MCP gateway serves signed-in people, because assignments, connections and approvals are defined for people. API keys are refused.
Approved and unchangedA tool call needs a tool that is approved and unchanged since review, on a server assigned to the caller at the request's classification.
Outbound guardUpstream servers must use HTTPS. Private, loopback, link-local and cloud metadata addresses are refused after DNS resolution, and redirects are not followed.
Fails closedA sealed vault, an unreadable policy or an enrolled device without a valid signed policy refuses the call.
Recorded
Every decisionServer, tool, caller, decision and reason, latency, upstream status, and a hash and size of arguments and result, in the audit log in the same transaction.
Device decisionsThe proxy reports each decision; every denial and every report is audited, so allowed calls have a record too.
Catalog changesServers, reviews, tool decisions, assignments, settings and connections, including whether a removed OAuth connection was revoked at its provider.
Govern serverThe catalog, the gateway and the vault-held credentials run in your installation.
Developer machinesThe endpoint agent pins the signing keys of your installation and keeps the proxy's policy current, cached for offline use.
Self-hosted and air-gappedLocal servers and servers on networks your operator allows, with nothing called outside your network.
Hosted by usWe run it for you. Custom servers, per-person OAuth and content retention depend on the plan; a self-hosted installation has no limits.
Get started
Set it up with the documentation.
Talk to our team.
Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.