MCP default action

This is the rule the Gateway applies to an MCP server that has no explicit rule of its
own. Set it under Policy → MCP default action.
Action
What developers experience
When to use it
Allow
Nothing changes
You want visibility first, controls later
Warn
A warning before the server is used
The usual starting point
Report
Nothing; usage is logged for review
You want a quiet audit trail
Block
The request is rejected
Locked-down environments
Per-server rules on MCP Inventory always override this default — so a strict default
with a few allowed servers, or a permissive default with a few blocked ones, are both
sensible shapes.
Where it applies
Enforced for Claude Code traffic today. Other tools are audited and appear in Activity;
their MCP enforcement follows.
Recommended path
Start at Warn, watch MCP Inventory fill up with what your team actually uses for a
week, set explicit rules for the servers you recognise, then decide whether to tighten the
default. Starting at Block works but generates support requests on day one.
Policy → MCP default action. Per-server rules on MCP Inventory override this default.