MCP Boundary by Impact Boundary Labs
Documentation navigation

MCP Boundary

MCP Boundary

MCP Boundary is a local check layer for MCP tool calls.

It sits between your agent and the MCP servers you choose to run through it. The agent can still use MCP tools, but calls with real effects can be made visible, limited, blocked, sent to local human review, and recorded before they reach the underlying server.

The core idea is simple:

Seeing a tool is not the same as permission to run every call.

An agent might know that a server has a send, delete, update, deploy, or write tool. MCP Boundary helps you decide what should happen for the concrete call the agent is asking for right now.

What You Get

MCP Boundary gives you:

  • a local mcpboundary command
  • a first-run local email demo
  • a localhost dashboard for setup, Agent Config, Builder, activity, and local approval review
  • a way to add multiple MCP server profiles
  • policy files for showing, hiding, allowing, blocking, limiting, and reviewing tools
  • activity records for calls that pass through MCP Boundary

It is meant for local MCP workflows where tools can create real side effects:

  • writing records
  • creating drafts
  • sending messages
  • changing tickets
  • deleting or moving data
  • triggering deployments or scripts
  • retrying writes after state has changed

If your MCP server is read-only, MCP Boundary may be less important. If your MCP tools can change things, it gives you a place to make those calls explicit.

Multiple MCP Servers

You can add several MCP servers as separate profiles:

gmail    -> mcpboundary serve gmail
github   -> mcpboundary serve github
postgres -> mcpboundary serve postgres

The tools are not merged into one giant shared list. Your agent gets separate MCP entries, and each running serve <profile> process protects one selected downstream MCP server.

First Real Setup

For a real MCP client, start from the dashboard:

paste existing MCP config in Setup
-> detect and import one server
-> copy Agent Config back into your MCP client
-> restart or reload the MCP client
-> run one safe tool call
-> check Activity

MCP Boundary does not edit your MCP client automatically. Import creates a local Boundary setup and also tries to load the server's tool list for Builder. This discovery step does not start the protected connection used by your agent. Agent Config is the replacement entry you copy back into the MCP client.

Optional Demo

The included local email demo does not connect to Gmail, Outlook, or any real mailbox. It is a safe way to see the product behavior:

search email       allowed
read thread        allowed
create draft       allowed
send email         blocked before execution

You can get the Windows and Linux builds (with SHA-256 checksums) from the download page.

From a downloaded ZIP on Windows:

powershell
.\mcpboundary.exe quickstart email

From a downloaded tarball on Linux:

sh
./mcpboundary quickstart email

That starts a connected local dashboard, prepares a replacement MCP config entry for your agent, and keeps running until you stop it with Ctrl+C.

For your own server, use the dashboard import path above. Save policy only when you want stricter behavior. In Builder, start by selecting a tool and changing its access or input rules; use Builder: Full Policy JSON only for complete developer Policy files.

How To Read These Docs

Use this order if you are new:

  • Getting Started - import an existing MCP config, copy Agent Config, and verify Activity.
  • How It Works - understand what sits between the agent and the MCP server.
  • MCP Tool Rules - see how tools become visible, allowed, blocked, limited, and bound to reviewed state.
  • Tested Servers And Limits - see what has actually been tested.
  • Real Gmail Setup - advanced guide for a real Gmail-style MCP server.
  • Glossary - look up product terms without leaving the documentation flow.
  • FAQ - common questions about retries, hidden effects, auth, and limits.
  • Limitations - understand what the current release does not claim or guarantee.

What It Is Not

MCP Boundary is not a hosted gateway, a cloud service, a replacement for your MCP server, a remote approval service, or a dashboard tool runner. It does not provide production security, data-loss prevention, or prompt-injection protection.

Only calls routed through MCP Boundary are checked. If the agent still has a direct MCP entry for the downstream server, that direct path bypasses the boundary.

See Limitations for the full list.

The Short Version

  Agent
    │  asks for a tool call
    ▼
  ┌──────────────────┐   allowed    ┌──────────────┐
  │   MCP Boundary   │ ───────────▶ │  MCP server  │
  │   checks call    │              └──────────────┘
  └──────────────────┘
    │  blocked
    ▼
  stops before the server runs - the dashboard shows what happened