Authenticate with your server
Keep your existing OAuth, JWT or session validation. Pass a verified, stable caller identifier from that context; provider credentials stay local.
Protect your MCP servers from unauthorized AI actions.
Put policy enforcement at the tools you operate. Your server authenticates the caller; Atellagent decides whether the requested action may proceed.
One protected tool handler.
Calls through Atellagent arrive with central authorization. When you enable direct MCP clients, their calls obtain that authorization at your server before executing the same handler.
Authorize each action
Evaluate the published tool and its exact arguments against applicable policy. A missing or invalid authorization stops the call before execution.
Keep the action record
Link the policy decision and reported outcome to the resource and caller identifier. A workflow and an Atellagent account for each caller are not required.
Integrate where tools execute.
- Enroll your MCP server
Use the existing Atellagent Client setup and publish your tools. An organization administrator reviews the connection.
- Connect the dispatch boundary
Route tool execution through the Client's protected handler. Keep native authentication and resource permissions in place.
- Review policy and verify
Test a harmless allowed and denied call. Enable direct MCP clients when ready; an administrator can block new direct calls later without restarting the runtime.
Direct clients are blocked by default. Protection covers tool calls that pass through the installed handler. Other endpoints or dispatch paths need their own enforcement.
In Enforce mode, organization policy restricts supported actions. Observe records potential policy outcomes; mandatory authorization and platform checks still apply. Review plan enforcement modes
Protect tools your organization runs.
Review your server's authentication, tool dispatch and policy needs with us.