The mcp policy object

⚠️

Preview — this feature is being built; the design below is the spec.

The mcp_policy object as the API returns it. Every field below appears in every response that returns this object; fields with no value are null rather than missing.

Example

{
  "type": "mcp_policy",
  "mode": "allowlist",
  "allowed_servers": [
    {
      "url_prefix": "https://mcp.example.com/",
      "note": "Internal CRM"
    },
    {
      "tunnel_id": "tnl_01JCE4G6J8L0N2Q4S6U8",
      "note": "On-prem ERP"
    }
  ],
  "require_tunnel_for_private": true,
  "updated_at": "2026-11-05T10:00:00Z"
}

Fields

Field	Type	Description
`type`	string	The object type, always `mcp_policy`.
`mode`	string	`open` (any public HTTPS server), `allowlist` (only listed servers and tunnels) or `disabled` (the `mcp_servers` field is refused).
`allowed_servers`	array	Entries with either `url_prefix` or `tunnel_id`.
`require_tunnel_for_private`	boolean	Refuse servers on private addresses unless reached through an MCP tunnel.
`updated_at`	string	When it last changed.

Returned by

legal_hold memory_consolidation

Was this page helpful?