Overview

The Swif MCP Security Policy inventories the MCP servers that AI coding agents on your devices are set up to use, and reports or blocks any that your policy doesn't allow.

MCP (Model Context Protocol) servers give AI agents extra tools and data, such as access to GitHub, a database, or an internal API. Developers can add them on their own, so it's easy to lose track of which servers agents can use. This policy gives you that visibility.

Swif reads the MCP settings of these agents, for every user on the device:

Claude Code, including project and plugin servers
Cursor
Claude Desktop
Codex

Each server is checked against your allowlist or blocklist, and appears in the MCP Security tab.

Swif collects MCP servers every 15 minutes, and right away when the policy is assigned or changed. Devices upload results only when something changed, plus once a day, so the MCP Security tab stays current without extra traffic.

Important: Blocking works in Claude Code and Cursor only. With When A Server Is Not Allowed set to block, Claude Code doesn't start servers your policy doesn't allow, and Cursor refuses their tool calls. Claude Desktop and Codex servers are only reported, in both modes. Start with log to see what would be blocked, before you switch to block.

Requirements

Requirement	Details
Operating systems	macOS, Linux, and Windows
Device ownership	Company-owned and BYOD
Agent	Swif Agentic Security agent 1.43.0 or later, installed and running. Deploy it with the Apple, Windows, or Linux Agentic Security Policy. Older agents ignore this policy without any error.

What Swif collects

For each MCP server, Swif records which package or host it runs, such as npm:@modelcontextprotocol/server-github or mcp.example.com.

Swif never collects a server's arguments, environment values, or tokens. API keys and other secrets in MCP settings stay on the device.

What isn't covered

MCP servers inside an OpenShell sandbox. The Swif OpenShell Sandbox Policy controls their network access.
An agent's other network traffic. Only MCP server settings are checked.
Other MCP clients beyond the four agents listed above.
Users who can change the agent's files: root on macOS and Linux, and administrators on Windows.

Settings reference

General

Setting	What it does	Default
Enabled	Collects the device's MCP servers and checks them against this policy. Turning it off stops collection on the device.	Off
When A Server Is Not Allowed	`log` reports the server in the MCP Security tab, and leaves it running. `block` also stops it. See What block does below.	`log`
Agents	The agents whose MCP servers are checked: `claude-code`, `cursor`, `claude-desktop`, `codex`. Servers of other agents are still listed, but not checked. Leave empty to check all supported agents.	All four
List Mode	`blocklist` or `allowlist`. See below.	`blocklist`
Block When A Server Cannot Be Judged	`block` mode only. What Claude Code and Cursor do when they can't check a server. See below.	Off

What block does

Agent	With `block`
Claude Code	Doesn't start servers that aren't allowed
Cursor	Refuses tool calls to servers that aren't allowed
Claude Desktop	Reports the server only
Codex	Reports the server only

claude.ai connectors in Claude Code. In block mode, the host lists also apply to claude.ai connectors used in Claude Code, in both list modes:

allowlist: a connector works only if its host is in Allowed Hosts. For example, add gmailmcp.googleapis.com for the Gmail connector, or mcp.canva.com for the Canva connector.
blocklist: a connector stops working if its host is in Blocked Hosts.

This applies to Claude Code only. Claude Code matches connectors against the host lists itself, and Swif never reads a connector's URL. So the MCP Security tab shows every connector as not evaluated, even one that the host lists have stopped.

What users see when a server is blocked

Claude Code and Cursor show this message:

Swif MCP policy: the MCP server NAME is not allowed on this device (REASON). Ask your administrator to approve it.

NAME is the server's name, and REASON explains why it isn't allowed.

When changes take effect

On the device: the policy applies at the device's next sync. After that, the device checks for changes every minute.
In Claude Code: Claude Code reads its list of servers when a session starts. In a session that's already open, servers that were already running aren't stopped, but their tool calls are refused.

Turn off blocking

Switching When A Server Is Not Allowed to log, turning off Enabled, or unassigning the policy removes Swif's Claude Code settings and Cursor hook. Servers work again from the user's next session.

Block When A Server Cannot Be Judged

Applies only in block mode. Sometimes Claude Code or Cursor can't check a server: the policy can't be read on the device, or the server's settings can't be found.

Setting	What happens
Off (default)	The call is allowed, and the problem is reported.
On	The call is blocked.

Risk of turning it on: if the device can't read the policy file, Claude Code and Cursor refuse every MCP call until the device repairs it, which takes about a minute.

In allowlist mode, when a server's settings can't be found:

Cursor refuses the call, whatever this setting is.
Claude Code follows this setting. With it off, Claude Code allows the call, and the server is reported.

List mode

Mode	Allowed	Not allowed (reported or blocked)
blocklist	Every server, except those in Blocked Packages or Blocked Hosts	Servers in the blocked lists
allowlist	Only servers in Allowed Packages or Allowed Hosts	Every other server

Start with blocklist and log. Once the MCP Security tab shows which servers your team uses, build your allowed lists, switch to allowlist, and then to block.

Packages

Local MCP servers run a package on the device. Identify them by package:

Setting	Use	Limit
Allowed Packages	Packages allowed in `allowlist` mode	256
Blocked Packages	Packages that aren't allowed, in either list mode	256

Package formats:

Type	Format	Example
npm package	`npm:name`	`npm:@modelcontextprotocol/server-github`
npm, one version	`npm:name@version`	`npm:@modelcontextprotocol/server-github@1.2.3`
npm, whole scope	`npm:@scope/*`	`npm:@acme/*`
Python package	`pypi:name`	`pypi:mcp-server-fetch`
Python, one version	`pypi:name==version`	`pypi:mcp-server-fetch==1.2.3`
Docker image	`docker:image`	`docker:ghcr.io/acme/mcp-server`
Docker, one tag	`docker:image:tag`	`docker:ghcr.io/acme/mcp-server:1.0`
Local program	`path:/absolute/path`	`path:/opt/acme/mcp-server`
Claude Code plugin	`plugin:name@marketplace`	`plugin:acme-tools@acme-marketplace`

Without a version, every version matches. With a version, only that version matches.

Hosts

Remote MCP servers run on another computer, and are identified by host:

Setting	Use	Limit
Allowed Hosts	Hosts allowed in `allowlist` mode	256
Blocked Hosts	Hosts that aren't allowed, in either list mode	256

Enter domain names, not URLs:

Entry	Matches
`example.com`	`example.com` and every name under it, such as `mcp.example.com`
`*.example.com`	Only names under it, such as `mcp.example.com`, not `example.com` itself
`192.0.2.10` or `localhost`	That IP address, or the device itself
`mcp.example.com:8443`	That host on that port only

Exceptions

Servers that are always allowed, even if a blocked list matches them. Each exception needs:

Field	What to enter	Required
Package Or Host	One package rule or host rule, written as in the lists above, such as `npm:@acme/mcp-tools` or `mcp.acme.com`	Yes
Reason	Why this server is allowed, up to 256 characters. Kept for audits.	Yes

You can add up to 64 exceptions.

How a server is checked

Exceptions win. A server that matches an exception is always allowed.
Blocked lists come next. A server in Blocked Packages or Blocked Hosts isn't allowed, in either list mode.
List mode decides the rest. In blocklist mode, everything else is allowed. In allowlist mode, only servers in the allowed lists are allowed.

Before you start

Deploy the Swif Agentic Security agent to the devices.
Decide which agents to check. Leave Agents empty to check all four.
List servers you already know you don't want, for your blocked lists.
Choose a pilot group of devices.

Create the policy

In Swif, go to Agentic Security > Policies.
Select Swif MCP Security Policy.
Set List Mode to blocklist, and When A Server Is Not Allowed to log.
Add any servers you want reported to Blocked Packages or Blocked Hosts.
Turn on Enabled.
Assign the policy to your devices and save.
Check the MCP Security tab to see which servers your team uses.
When you're ready, change When A Server Is Not Allowed to block.

Example configurations

Example 1: Discover what's in use

Setting	Value
Enabled	On
When A Server Is Not Allowed	`log`
List Mode	`blocklist`
Blocked Packages	Empty
Blocked Hosts	Empty

Every server is allowed and listed, so you can see which MCP servers your team uses before setting rules.

Example 2: Block specific servers

Setting	Value
When A Server Is Not Allowed	`block`
List Mode	`blocklist`
Blocked Packages	`npm:unapproved-mcp-server`
Blocked Hosts	`mcp.untrusted-vendor.com`

Every server is allowed, except these two. Claude Code doesn't start them, and Cursor refuses their tool calls. In Claude Desktop and Codex, they're reported.

Example 3: Approved servers only

Setting	Value
When A Server Is Not Allowed	`block`
List Mode	`allowlist`
Allowed Packages	`npm:@modelcontextprotocol/server-github`, `npm:@acme/*`
Allowed Hosts	`mcp.acme.com`, `gmailmcp.googleapis.com`
Block When A Server Cannot Be Judged	On
Exceptions	Package Or Host: `pypi:mcp-server-fetch`; Reason: Approved by security for the data team

Only GitHub's official server, your company's npm packages, your company's remote server, the Gmail connector, and the approved exception are allowed. In Claude Code and Cursor, every other server is blocked. Servers that can't be checked are blocked too.

Verify the policy

Confirm that the device is online and the policy shows as applied.
On a test device, add a known MCP server to a supported agent, such as Claude Code.
Wait up to 15 minutes for the next collection, then open the MCP Security tab.
Confirm that the server is listed, and shows the result you expect.
In block mode, start a new Claude Code session, and check that a server that isn't allowed doesn't start. In Cursor, check that its tool calls are refused with the Swif MCP policy message.

Troubleshooting

A server isn't listed

Check that Enabled is on, and the Agentic Security agent is running.
Wait up to 15 minutes. Swif collects MCP servers every 15 minutes.
Check that the server is set up in Claude Code, Cursor, Claude Desktop, or Codex. Other MCP clients aren't covered.
Check that the server isn't inside an OpenShell sandbox.

A server is listed but not checked

Its agent isn't in Agents. Add the agent, or leave Agents empty to check all of them.

A server I allowed is still reported

Check whether it's also in a blocked list. Blocked lists apply in both modes. Add an exception if it should always be allowed.
Check the package format, such as npm: or pypi:, and the version. A rule with a version matches only that version.
For hosts, check that you entered a domain name, not a URL.

A server that isn't allowed is still running

Check that When A Server Is Not Allowed is set to block. In log mode, servers are only reported.
Check the agent. Blocking works only in Claude Code and Cursor. Claude Desktop and Codex servers are only reported.

A claude.ai connector stopped working in Claude Code

In block mode, the host lists apply to claude.ai connectors in Claude Code:

allowlist: add the connector's host to Allowed Hosts, such as gmailmcp.googleapis.com for Gmail or mcp.canva.com for Canva.
blocklist: check whether the connector's host is in Blocked Hosts.

A claude.ai connector shows as not evaluated

This is expected. Claude Code checks connectors against the host lists itself, and Swif doesn't read connector URLs. So every connector shows as not evaluated in the MCP Security tab, even one the host lists have stopped.

A user sees "Swif MCP policy: the MCP server … is not allowed on this device"

The server isn't allowed by your policy. The message includes the reason. To allow it, add it to your allowed lists, or add an exception with a reason.

Blocking doesn't work on a device

Check that the device runs Swif Agentic Security agent 1.43.0 or later. Older agents ignore this policy without any error.
In Claude Code, start a new session. Claude Code reads its server list when a session starts.

Claude Code or Cursor blocks a server I allowed

In allowlist mode, Cursor refuses calls to a server whose settings can't be found. Claude Code allows them unless Block When A Server Cannot Be Judged is on.
If Block When A Server Cannot Be Judged is on, calls are refused whenever a server can't be checked. If the device can't read the policy file, every MCP call is refused for about a minute until the device repairs it. Check that the Agentic Security agent is running, or turn the setting off.

Related resources

Swif

MCP

Introduction to the Model Context Protocol