Skip to main content
Corridor’s MCP Compliance features ensure that AI coding assistants are used in a controlled, auditable way. This addresses questions like: “Are developers only using approved AI tools? Can we prove we’re enforcing policies during AI-assisted development?”
MCP compliance is currently supported with Cursor and Claude Code via Hooks.

​
Why control MCP servers?

MCP servers can access local files, make network requests, execute code, and read environment variables. Without controls, developers might use MCP servers that leak sensitive code to unauthorized services or introduce security vulnerabilities.

​
How it works

MCP compliance is enforced via Hooks—deterministic scripts that run before MCP calls are made. When an AI agent attempts to use an MCP server, Corridor’s hook intercepts the call, checks it against your team’s policies, and allows or blocks it accordingly. This happens transparently without adding latency to permitted requests.
  • See what’s being used: Every MCP server invocation is logged via hooks
  • Enforce policies: Hooks block unauthorized servers before they can execute
  • Audit trail: Full history of AI tool usage for compliance

​
Compliance modes

Configure MCP compliance at the team level:
ModeDescription
DisabledNo restrictions—all MCP servers allowed
AllowlistOnly specified servers are permitted (most secure)
BlocklistAll servers except specified ones are permitted (flexible)

​
Configuring policies

  1. Navigate to the Compliance tab in the Corridor dashboard
  2. Select a compliance mode (Allowlist or Blocklist)
  3. Add servers to your allow or block list
  4. Click Save

​
Server entry format

Each entry is matched against the canonical name of the MCP server your IDE is about to invoke. Matching is case-insensitive, and dots, spaces, and underscores are equivalent — so claude.ai Asana, Claude.ai Asana, and claude_ai_asana all refer to the same server. The easiest way to write an entry is to copy the display name as it appears in your IDE’s MCP panel:
Server typeExample entry
A connector hosted by an AI vendorclaude.ai Asana
A standalone remote MCP serverlinear
When adding entries:
  • Capitalization doesn’t matter — claude.ai Asana, Claude.ai Asana, and claude.ai asana are all treated as the same server.
  • Use dots, spaces, or underscores to separate words in a multi-word name — pick whichever matches what you see in the IDE. claude.ai Asana and claude_ai_asana work identically.
If a server is unexpectedly blocked, the error in your IDE will include the tool name Corridor saw, in the form mcp__server_name__tool_name. The portion between mcp__ and the next __ is the canonical server identifier — entering that name (or its display equivalent with dots and spaces) in your allowlist will match it.

​
How policies are enforced

When a developer uses an AI assistant in Cursor or Claude Code:
  1. MCP call intercepted: The AI attempts to call an MCP server and Corridor’s hook triggers
  2. Policy checked: The hook evaluates the server against your team’s compliance policy
  3. Action taken: The request is allowed through or blocked with a compliance error
  4. Logged: All invocations are recorded for audit
When a user belongs to multiple teams, the most restrictive policy applies—allowlist intersection and blocklist union.

​
Next steps

Guardrails

Configure security guardrails

Corridor MCP

Explore Corridor’s MCP tools