Skip to content
QDataCloud

Surface

MCP Security

Model Context Protocol is how many agents reach tools. In this product it is a tool-runtime surface: which agent identity may call which tool, with which arguments, under policy.

It is not the product engine, not a separate SKU, and not prompt inspection as the core control. The product is still QData Identity Security.

What we authorize

An MCP server is not one permission. Each tool is a resource. The subject is the agent. The action is the tool call. Arguments belong in context.

  • Agent identity

    The subject of the check is the agent, not the chat UI and not the engineer’s SSO session.

  • Tool as resource

    Each MCP tool is a resource you can allow or deny. A server full of tools is not one permission.

  • Arguments as context

    Which file, which amount, which environment — those arguments belong in context, not in a standing role.

  • MCP gateway PEP

    Typical enforcement sits on an MCP gateway in the path. Without it, you can still decide and simulate.

Agent to tool to resource

The same allow, deny, or require-approval decision as any other NHI path. MCP only changes what sits between the agent and the resource.

  1. Agent
  2. MCP
  3. Tool
  4. Resource
Agent to MCP to tool to resource. Authorization still uses subject, action, resource, and context.

Enforcement is a gateway you run

Typical PEP for this surface is an MCP gateway on the path. If the agent talks to tools without that gateway — or without an SDK check — you can still inventory and simulate. You cannot honestly claim the tool call was blocked. The general PEP list is on the security model.

What this page is not

  • Not the platform engine

    QData Identity Security does not run “on MCP”. MCP is one way agents call tools.

  • Not prompt DLP

    Full prompts are not the default payload to the SaaS. The control is the tool call as an action.

  • Not the only agent path

    Agents that call ordinary APIs still need identity and authorization. MCP is optional.

SHADOWALLOWDENY

Observation is not enforcement

A decision is not a block unless a PEP is on the path: SDK, gateway, MCP gateway, sidecar, or connector.

Related pages

  • AI Agent Security

    Why agents need identity: no human session, tool calls as actions.

    Open AI Agent Security

  • Authorization

    The same four-part check, including when the resource is not MCP.

    Open authorization

  • Developers

    Conceptual check first. Gateway and SDK when those hosts are public.

    Start building

  • Security model

    A gateway that is not on the path does not block.

    See security

Questions

No. It is a surface of QData Identity Security. The product name does not change.

Authorize the tool call

Start from the agent category, or from a conceptual authorization check.

AI Agent SecurityStart building