> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corridor.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Compliance

> Control which AI tools and MCP servers your team can use for secure AI-assisted development.

Corridor's MCP Compliance features ensure that AI coding assistants are used in a controlled, auditable way. This addresses questions like: "Are developers only using approved AI tools? Can we prove we're enforcing policies during AI-assisted development?"

<Note>
  MCP compliance is currently supported with **Cursor**, **Claude Code**, **Devin Desktop**, **Factory Droid**, and **OpenAI Codex** via Hooks.
</Note>

## Why control MCP servers?

MCP servers can access local files, make network requests, execute code, and read environment variables. Without controls, developers might use MCP servers that leak sensitive code to unauthorized services or introduce security vulnerabilities.

## How it works

MCP compliance is enforced via **Hooks**—deterministic scripts that run before MCP calls are made. When an AI agent attempts to use an MCP server, Corridor's hook intercepts the call, checks it against your team's policies, and allows or blocks it accordingly. This happens transparently without adding latency to permitted requests.

* **See what's being used**: Every MCP server invocation is logged via hooks
* **Enforce policies**: Hooks block unauthorized servers before they can execute
* **Audit trail**: Full history of AI tool usage for compliance

### Compliance modes

Configure MCP compliance at the team level:

| Mode          | Description                                                |
| ------------- | ---------------------------------------------------------- |
| **Disabled**  | No restrictions—all MCP servers allowed                    |
| **Allowlist** | Only specified servers are permitted (most secure)         |
| **Blocklist** | All servers except specified ones are permitted (flexible) |

### Configuring policies

1. Navigate to the **Compliance** tab in the Corridor dashboard
2. Select a compliance mode (**Allowlist** or **Blocklist**)
3. Add servers to your allow or block list
4. Click **Save**

### Server entry format

Each entry is matched against the canonical name of the MCP server your IDE is about to invoke. Matching is case-insensitive, and dots, spaces, and underscores are equivalent — so `claude.ai Asana`, `Claude.ai Asana`, and `claude_ai_asana` all refer to the same server.

The easiest way to write an entry is to copy the **display name** as it appears in your IDE's MCP panel:

| Server type                        | Example entry     |
| ---------------------------------- | ----------------- |
| A connector hosted by an AI vendor | `claude.ai Asana` |
| A standalone remote MCP server     | `linear`          |

When adding entries:

* **Capitalization doesn't matter** — `claude.ai Asana`, `Claude.ai Asana`, and `claude.ai asana` are all treated as the same server.
* **Use dots, spaces, or underscores** to separate words in a multi-word name — pick whichever matches what you see in the IDE. `claude.ai Asana` and `claude_ai_asana` work identically.

<Tip>
  If a server is unexpectedly blocked, the error in your IDE will include the tool name Corridor saw, in the form `mcp__server_name__tool_name`. The portion between `mcp__` and the next `__` is the canonical server identifier — entering that name (or its display equivalent with dots and spaces) in your allowlist will match it.
</Tip>

### How policies are enforced

When a developer uses an AI assistant in Cursor, Claude Code, Devin Desktop, Factory Droid, or OpenAI Codex:

1. **MCP call intercepted**: The AI attempts to call an MCP server and Corridor's hook triggers
2. **Policy checked**: The hook evaluates the server against your team's compliance policy
3. **Action taken**: The request is allowed through or blocked with a compliance error
4. **Logged**: All invocations are recorded for audit

When a user belongs to multiple teams, the most restrictive policy applies—allowlist intersection and blocklist union.

## Next steps

<CardGroup cols={2}>
  <Card title="Guardrails" icon="shield-check" href="/features/guardrails">
    Configure security guardrails
  </Card>

  <Card title="Corridor MCP" icon="plug" href="/features/corridor-mcp">
    Explore Corridor's MCP tools
  </Card>
</CardGroup>