Inspects the SQL text that Snowflake MCP tools carry in their query argument and denies any statement in a mutating or destructive class — DROP, TRUNCATE,…
snowflakeguard-warehouse-sqlingresssqlreadonlysoc2pci-dsssox
Inspects the raw GoogleSQL string carried by BigQuery write-capable query tools and denies any statement in a state-changing class — DML…
Denies the stripe api write meta-tool — the single raw passthrough on the official Stripe MCP server that can execute any Stripe POST, PATCH, PUT, or DELETE…
Denies every Microsoft 365 tool call whose verb segment is delete- or cancel- unless the caller's IdP token carries the placeholder group m365-admin.
Denies every destructive QuickBooks Online (QBO) tool call on the agent channel before it reaches the MCP server.
Gates the QuickBooks Online money-movement creation tools — create payment, create bill payment, create refund receipt, create transfer, and create deposit —…
Inspects the SQL statement string that Databricks SQL-executing tools carry in their argument and denies any statement that performs a write, schema change,…
databricksguard-warehouse-sqlingresssqlreadonlypci-dsssoxsoc2
Blocks create vendor and update vendor calls whose arguments carry a vendor's payment coordinates — bank account number, routing / ACH branch details — or…
Strips the irreversible submit flag from Stripe update dispute tool calls.
striperequire-human-approvaldisputesseparation-of-dutiestransformingresssox
Denies the QuickBooks Online tools create journal entry and update journal entry at ingress for every caller except those whose IdP claims include the…
Instantiates policy family PF-10 (guard-vendor-banking) — the anti-BEC / payment-fraud control — for the Oracle NetSuite MCP Standard Tools SuiteApp.
Denies the NetSuite record-write tools ns createRecord and ns updateRecord when they target a financial-transaction record type — journalentry (including the…
The least-privilege baseline for Microsoft 365 through the gateway: every tool call is allowed only if it is a read , or the caller's IdP token carries the…
Establishes the least-privilege baseline for the GitHub MCP connector on the agent channel.
Establishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools —
striperole-gate-writesingressleast-privilegerbacsoc2pci-dsssoxgdpr-ccpa
Keeps a human in the loop on the two GitHub actions that consummate a code change: merging a pull request and approving one .
Denies Stripe refund tool calls — money out, irreversible — unless the caller's IdP groups include finance or billing-admin.