# MCP default action

This is the rule the Gateway applies to an MCP server that has **no explicit rule of its
own**. Set it under **Policy → MCP default action**.

| Action | What developers experience | When to use it |
|---|---|---|
| **Allow** | Nothing changes | You want visibility first, controls later |
| **Warn** | A warning before the server is used | The usual starting point |
| **Report** | Nothing; usage is logged for review | You want a quiet audit trail |
| **Block** | The request is rejected | Locked-down environments |

Per-server rules on **MCP Inventory** always override this default — so a strict default
with a few allowed servers, or a permissive default with a few blocked ones, are both
sensible shapes.

## Where it applies

Enforced for Claude Code traffic today. Other tools are audited and appear in Activity;
their MCP enforcement follows.

## Recommended path

Start at **Warn**, watch **MCP Inventory** fill up with what your team actually uses for a
week, set explicit rules for the servers you recognise, then decide whether to tighten the
default. Starting at **Block** works but generates support requests on day one.

<!-- shot:policy-mcp-default -->
![Policy → MCP default action. Per-server rules on MCP Inventory override this default.](https://docs.sentilai.com/uploads/images/gallery/2026-08/GJOpolicy-mcp-default.png)
*Policy → MCP default action. Per-server rules on MCP Inventory override this default.*