GPR-005 · high risk
Review new MCP servers
Require review when a supported harness attempts to use an MCP server that has not been reviewed.
Decision
review
Matcher
mcp = unreviewed-mcp-server
Reviewed
2026-08-09
Safe test cases
matching synthetic case
mcp = unreviewed-mcp-server → review
different benign synthetic case
mcp = benign-unreviewed-mcp-server → unmatched
Limitations
- MCP discovery and enforcement vary by harness and event surface.
Review before applying
This recipe is a starting point, not a universal security policy. Open it in Policy Studio, replace example identifiers where necessary, review scope and blast radius, simulate where supported, and use the normal approval flow before enforcement.
Recipe SHA-256: 3b821d75ad5837805ce9102f71f637c42fd281cb98f816c1dff8cc3f198931d7
When a policy is saved and delivered through Guard Cloud, it uses the existing Guard policy-bundle compiler. If the policy-bundle signing key is configured, that compiler produces an RSA-PSS-SHA256 signed bundle that local Guard verifies before applying.