Deterministic authorization · No LLM in the loop

Models can request actions.
Visor decides whether they are allowed.

MCP Visor is a self-hosted policy enforcement proxy for AI agents. It evaluates every MCP tools/call before the request reaches the server — deterministically, without an LLM.

Install Visor See the boundary

Quickstart $ go install github.com/themayursinha/mcp-visor/cmd/mcp-visor@latest

The boundary

Prompt-only controls are useful guidance. They are not an execution boundary.

Agents can now read files, call APIs, run commands, and modify infrastructure through MCP tools. A natural-language warning provides weak assurance the moment the model is confused, injected, or adversarial.

Visor sits between the AI client and the MCP server. The agent requests an action; Visor evaluates policy before the request reaches the tool. Unknown tools fail closed. Sensitive paths are blocked by pattern. A read followed by an outbound send is denied as a chain. High-risk actions wait for approval.

policy.yaml · default_action: deny

version: "1.0"
default_action: deny

servers:
  - name: "filesystem"
    allowed: true
    tools:
      - name: "file_read"
        rules:
          - type: deny_path
            patterns:
              - "**/.env"
              - "**/*.pem"

tool_chains:
  - name: "prevent_exfiltration"
    sources: "file_read"
    sinks: "http_post"
    action: deny # within window

The boundary, drawn

Agent

Requests

tools/call

→eval

Visor

Policy decision

deterministic · no LLM

→relay

Server

Receives

only allowed calls

denied — never relayed, audit committed allowed — audit fsynced before relay Visor — the action boundary

The chain

What the agent does. What Visor decides.

1 · Agent

Requests an action

A valid JSON-RPC tools/call with an id arrives at the proxy.

→

2 · Policy

Rules are evaluated

Allow, deny, approval, redaction, chain, and session-taint rules run in order.

→

3 · Visor

Deterministic decision

No LLM in the loop. The same input always produces the same decision.

→

4 · Server

Only allowed calls relay

Audit is durably committed before any request reaches the MCP server.

Notification-form tools/call is dropped without response. Duplicate method keys and JSON-RPC batches containing tools/call are blocked before relay.

Enforcement

What the proxy actually enforces

allow / deny

Every tools/call is matched against server, tool, and argument rules before relay. Unknown tools fail closed by default.

approval

High-risk actions wait for explicit human approval instead of proceeding on model intent alone.

redaction

Sensitive fields can be redacted from tool arguments and responses before they cross the boundary.

chains & taint

A read followed by an outbound send is denied as a chain. Session state tracks taint across the conversation.

An allowed action that cannot prove itself is a denial.

Visor will not relay a valid tool call unless its final allow record has been durably committed to the configured audit sink. A marshal error, short write, sync failure, or closed file converts the call to a denial with zero relay.

# invariant T-AUDIT-001
on allow: append_record(sink)
required: full_write + fsync
on failure → deny, zero relay

Put the boundary between your agent and your infrastructure.

Self-hosted, open source, deterministic. No model in the decision path, no telemetry leaving your network.

Install Visor Read the doctrine

$ go install github.com/themayursinha/mcp-visor/cmd/mcp-visor@latest
$ mcp-visor serve --demo
pre-built binaries + checksums on Releases

Models can request actions.Visor decides whether they are allowed.