mcp-guardrail-gateway

Design a security policy for our MCP server: only admins can call delete and write tools; restrict the file_path argument to /workspace/project; block requests with prompt injection patterns; redact emails and phone numbers in results, and record auditable logs.

An actionable gateway policy covering role permissions, argument constraints, injection detection, PII redaction, and audit requirements.

Simulate an MCP tool call review: the user role is analyst and calls the export_customer_data tool. Check whether the arguments include unauthorized fields or sensitive data requests, redact ID numbers, emails, and addresses in the output, and then decide whether to allow it with reasons.

A review result explaining compliance status, what was blocked or redacted, and the final allow or deny decision.

Create a tamper-evident audit log template for this MCP access flow: include request time, user role, called tool, original argument summary, matched policy rules, redaction actions, result status, and a hash verification value for later security tracing and compliance checks.

A structured audit log template or example that helps trace policy enforcement and verify log integrity.