# MCP · Neural Inverse Govern

> A catalog of MCP servers reviewed tool by tool, assigned to the organisation, teams or projects, delivered as a signed manifest and called through a gateway that holds the credentials.

Source: https://neuralinverse.com/govern/mcp/

---

![](/photos/facility.jpg)

[Neural Inverse Govern / MCP](https://neuralinverse.com/govern/)

# Only reviewed MCP servers and approved tools reach your agents.

A catalog of MCP servers reviewed tool by tool, assigned to the organisation, teams or projects, delivered as a signed manifest and called through a gateway that holds the credentials.

Servers

Remote and local, reviewed per tool

Assignment

Deny by default, deny wins

Credentials

Encrypted in Govern's vault

Delivery

Ed25519-signed manifest

Coding tools

Local MCP proxy on enrolled devices

Overview

MCP is how AI agents reach tools and data. Govern holds the approved catalog of MCP servers: who added each one, which tools a reviewer allowed, which are read or write and which need a person's approval for each call. Remote servers are called through Govern's MCP gateway, which checks every call, injects the credential and records the decision. On developer machines, a local proxy applies the same catalog and your agent policy to the MCP servers that coding tools start themselves.

[What it does ↓](https://neuralinverse.com/#capabilities)[How it works ↓](https://neuralinverse.com/#workflow)[Enforced and recorded ↓](https://neuralinverse.com/#enforcement)[Where it runs ↓](https://neuralinverse.com/#where)[Get started ↓](https://neuralinverse.com/#get-started)

What it does

## What MCP governance covers.

Which servers and tools exist, who may use them, with which credentials, and what happened on each call.

- **Server catalog:** Remote servers, which Govern proxies, and local servers, which the client runs from a pinned package with an exact version and digest. Start from a list of starter servers or add your own.
- **Tool discovery:** Govern lists a remote server's tools itself. For a local server, an administrator uploads the tool list a client produced; Govern never runs packages.
- **Review per tool:** A reviewer approves or rejects the server and decides each tool: allowed or blocked, read or write, and whether each call needs approval. The person who submitted a server cannot review it unless you allow self-review.
- **Changed tools go back to review:** Each tool's definition, description included, is hashed. A new or changed tool waits as pending, and a server whose tools changed is marked changed until a reviewer looks again. Editing what a server runs sends it back to draft.
- **Assignments:** Allow, require or deny a server for the organisation, a team or a project. A deny wins; required servers are installed and cannot be turned off.
- **Classification ceiling:** Each server is cleared up to a data classification. A server cleared for internal is never delivered to a confidential project, and raising its ceiling sends it back to review.
- **Credentials:** An organisation-held key or OAuth client per server, or each person's own connection by API key or OAuth with PKCE. Values are encrypted in Govern's vault, bound to the organisation, server, person and field, and never returned.
- **MCP gateway:** People call remote servers through Govern with their own sign-in, never seeing the upstream address or its credentials. Only tool calls are forwarded; the server's own instructions are dropped because no reviewer approved them.
- **DLP on arguments and results:** Arguments, results and upstream errors are scanned at the request's classification: redacted at public and internal, removed or refused above that and in regulated projects.
- **Call approvals:** A write tool marked for approval waits for a person with MCP approval rights, never the caller, who sees the checked arguments. The approved call goes through once.
- **Limits:** Rate limits per person and server and per server for the organisation, and size limits on arguments and results.
- **Signed manifest:** Each person receives an Ed25519-signed list of their servers and callable tools for a project, with an expiry you set for offline use. Local servers include their tool lists, so clients can enforce them too.
- **Enforcement on developer machines:** On an enrolled device, a local MCP proxy decides every server start and tool call of the AI coding tools against the signed catalog and your agent policy's MCP rules. A refused call never reaches the server, and refused tools are left out of the tool list.
- **Configuration injection:** The proxy is written into the MCP configuration of Claude Code, Cursor, Windsurf, VS Code, Gemini CLI, Codex, Cline, Roo Code, Zed, Copilot CLI, Amazon Q and other tools, keeping a byte-identical restore. Remote entries named after a catalog server are pointed at the gateway.
- **Drift reports:** Clients report tool lists of local servers that differ from the reviewed list, and devices report the mode their proxy runs in.
- **Call activity:** Every gateway and proxy decision with caller, server, tool, outcome, reason, latency, DLP findings and the approval behind it. Content is stored only if you turn it on, for a retention you set.

The gateway forwards tools only: MCP resources and prompts are not passed through. Govern cannot verify which package a local client really runs; the digest check and local tool blocking happen on the device, so a reviewer must read a local server's command and arguments. The proxy runs as the developer; managed settings keep it in place.

How it works

## From a new server to a recorded tool call.

1.  Add
    
    Add a starter or custom server as a draft with no usable tools.
    
2.  Discover
    
    Govern lists the remote server's tools, or you upload a local server's list.
    
3.  Review
    
    Someone other than the submitter approves each tool, read or write, with or without call approval.
    
4.  Assign
    
    Allow, require or deny the server for the organisation, teams or projects.
    
5.  Deliver
    
    Clients and the device proxy receive the signed manifest of callable servers and tools.
    
6.  Call
    
    The gateway or the proxy decides each call, and the decision is recorded.
    

Who uses it

## Built for every role that answers for AI.

- **Platform and AI teams:** Add servers, run discovery, set credentials and assign servers to teams and projects.
- **Security reviewers:** Review servers and tools, decide which writes need approval, and set classification ceilings.
- **Approvers:** Decide write tool calls that wait for a person, seeing the checked arguments.
- **Engineers:** Connect their own account to servers that need it, and use the tools assigned to them in their coding tools.

Enforced and recorded

## Decided on every call, recorded with it.

Remote tool calls are decided by the MCP gateway on the server. Local servers are decided by the proxy on enrolled devices.

Enforced

- **People only at the gateway:** The MCP gateway serves signed-in people, because assignments, connections and approvals are defined for people. API keys are refused.
- **Approved and unchanged:** A tool call needs a tool that is approved and unchanged since review, on a server assigned to the caller at the request's classification.
- **Outbound guard:** Upstream servers must use HTTPS. Private, loopback, link-local and cloud metadata addresses are refused after DNS resolution, and redirects are not followed.
- **Fails closed:** A sealed vault, an unreadable policy or an enrolled device without a valid signed policy refuses the call.

Recorded

- **Every decision:** Server, tool, caller, decision and reason, latency, upstream status, and a hash and size of arguments and result, in the audit log in the same transaction.
- **Device decisions:** The proxy reports each decision; every denial and every report is audited, so allowed calls have a record too.
- **Catalog changes:** Servers, reviews, tool decisions, assignments, settings and connections, including whether a removed OAuth connection was revoked at its provider.

Where it runs

## On the server and on every developer machine.

[Deployment options](https://neuralinverse.com/deployment/)

- **Govern server:** The catalog, the gateway and the vault-held credentials run in your installation.
- **Developer machines:** The endpoint agent pins the signing keys of your installation and keeps the proxy's policy current, cached for offline use.
- **Self-hosted and air-gapped:** Local servers and servers on networks your operator allows, with nothing called outside your network.
- **Hosted by us:** We run it for you. Custom servers, per-person OAuth and content retention depend on the plan; a self-hosted installation has no limits.

Get started

## Set it up with the documentation.

-   [Govern overview](https://neuralinverse.com/docs/govern/)
-   [Agent policy](https://neuralinverse.com/docs/govern/agent-policy/)
-   [Approvals](https://neuralinverse.com/docs/govern/approvals/)
-   [Third-party AI coding tools](https://neuralinverse.com/docs/govern/third-party-tools/)
-   [Context MCP endpoint](https://neuralinverse.com/docs/context/mcp/)

Related

[Agent policy and approvals →

Allow, ask and deny rules for coding agents, with named approvers.](https://neuralinverse.com/govern/agent-policy/)[Third-party AI tools →

The control level Govern has over each third-party AI coding tool.](https://neuralinverse.com/govern/third-party-tools/)[Agents →

Agent identities, consent from the people they act for, delegation limits and governed calls to remote agents.](https://neuralinverse.com/govern/agents/)

![](/photos/team.jpg)

## Talk to our team.

Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.

[Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)