Create Security Policies for MCP Servers

Create security policies to control the data that passes through an MCP gateway, thereby reducing the risk of an AI agent or MCP server receiving data that it shouldn't.

Learn More About Security Policies

See Business and Security Policies for MCP Gateway.

Prerequisites for Security Policies

Establish a connection to the MCP servers that you want to manage.

See Define MCP Servers to Manage.

Create a PII Detection Security Policy

Create a personally identifiable information (PII) detection security policy to detect sensitive data in MCP gateway traffic and block or redact it.

  1. Open a project.
    1. In the navigation pane, select Projects.
    2. Select the project that contains the MCP gateway.
  2. In the left toolbar, select MCP Gateway .
  3. In the Security policies section, select Add.

    The Add security policy panel appears.

  4. Select PII Detection.
  5. Configure required fields for your PII detection security policy:
    • Name: Enter a name for the PII detection security policy.
    • Identifier: Oracle Integration generates this value using the Name value.
    • Description: Describe the security policy.
  6. Click Add.
  7. On the Detection tab, select the compartment OCID where the OCI Language service is available.
  8. Select the built-in detectors for finding sensitive data, such as email, telephone or fax (US), social security number, or others.
  9. If the detector you need to use is not listed, click Add Pattern at the bottom of the list to add custom detectors.
  10. Click the Enforcement tab.
  11. Select the scope of PII detection enforcement to apply from the Scope list:
    • MCP gateway: Apply enforcement to requests or responses that pass through the MCP gateway.
    • MCP server: Apply enforcement to requests or responses that pass through a specific MCP server.
    • MCP tool: Apply enforcement to requests or responses that pass through a specific tool.
    If You Select ... Then ...
    MCP gateway
    1. Select to apply enforcement to the request, response, or both.
    MCP server
    1. Select the specific MCP server.
    2. Select to apply enforcement to the request, response, or both.
    MCP tool
    1. Select the specific MCP server.
    2. Select the specific MCP tool.
    3. Select to apply enforcement to the request, response, or both.

    If you selected Target tool, the Inclusion List field is displayed.

  12. Select the payload fields to include in PII scanning. Only selected fields are inspected.
  13. Click the Action tab.
  14. From the Primary Action list, select an action:
    • Block: Prevents traffic containing detected PII.
    • Redact: Masks PII. If selected, chose the appropriate enforcement mode, then specify additional details if prompted:
      If You Select ... Then ...
      Mask
      1. In the Masking Character field, specify the character to use to mask detected PII (for example, *, #, or others).
      2. From the Unmask Options list, select an option:
        • FROM_END: Select to begin masking PII from the end of the PII.
        • FROM_START: Select to begin masking PII from the start of the PII.
      3. Number of Characters Left Unmasked: Enter the number of characters to leave unmasked.
      Replace Enter the replacement value to use when PII is detected.
      Remove No additional fields are displayed.
  15. Review your selections, then click Save.

Next steps:

Create a Tool Filter Security Policy

Not all tools in an MCP server need to be exposed and discoverable by AI agents. Use a tool filter for an MCP server to define the tools that are available through the MCP gateway.

Need to expose different tools in different MCP gateways? Define multiple tool filters for the MCP server.
  1. Open a project.
    1. In the navigation pane, select Projects.
    2. Select the project that contains the MCP gateway.
  2. In the left toolbar, select MCP Gateway .
  3. In the Security policies section, select Add.

    The Add security policy panel appears.

  4. Select Tool filter.

    The Add security policy: tool filter panel is displayed.

  5. Configure required fields for your tool filter:
    • Name: Name for your tool filter. Provide a descriptive name so that you know what the filter does.
    • Identifier: Oracle Integration generates this value using the Name value.
    • Description: Additional information about the filter, if desired.
  6. Click Add.

    The Tool filter page is displayed.

  7. Configure which tools are discoverable in your MCP server.
    • MCP server: Select the MCP server for which to define discoverable tools.
    • Include Tools: Click to display the available tools on the MCP server. Select the tools that you want to be discoverable on this MCP server with this tool filter.
  8. Click Save.

Next steps: