MCP
A gate between your agent and the MCP servers you declare.
An MCP server can offer any tool it likes, and an agent will call what it’s told to. Constle puts each server you declare behind a gate outside the sandbox, where your rules decide which calls go through.
What the gate does
1
Only the tools you list, once you list them.
List the tools it may call on each server. Calls through the gate to any other tool are refused and logged. An empty list allows none, and if you leave the list out, every tool is allowed.
2
Resources and prompts only if you list them.
Reading resources or prompts needs your say-so. Tool calls go through the tool checks, while the handshake,
ping,tools/list, notifications and responses pass. Resource, prompt, completion and logging requests pass only if the server’smethodslist names them, and any other request the agent sends is refused. What the server sends, its own requests included, is relayed without method checks.3
Named calls that pass through the gate wait for your yes.
Name a tool, and its calls that pass through the gate wait for a yes.
4
Caps on priced calls that pass through the gate.
Price an MCP server and set a cap. Among calls that pass through the gate, the one that crosses the cap is the last one through, and the run stops.
5
Constle keeps the real address on the host.
Constle never passes your MCP servers’ real addresses into the sandbox. The agent gets one variable that points at the gate.
6
One call, read one way.
A request body with duplicate or case-colliding keys is refused, so the body the gate checks can be read only one way.
mcp:
servers:
- id: issues
url: https://mcp.issues.internal/mcp # stays on the host
tools: [list_issues, create_issue] # any other tool is refused at the gateWhere it stops.
The agent still sees every tool’s name through tools/list. The gate matches names and doesn’t judge arguments or the content servers send back. An MCP server you run inside the agent’s own image isn’t gated. What it sends out meets the same proxy and allowlist.
Traffic to hosts you allow isn’t gated. If an allowed host shares a server with an MCP server, a request can reach that MCP server past the gate, with no allowlist check, approval or metering. So don’t allow a host that shares a server with one of your MCP servers.
The gate speaks MCP over Streamable HTTP, revision 2025-06-18.
Does it scan MCP servers for malicious tools?
No. It decides which calls that pass through the gate reach them.
Does it work with servers over standard input and output?
The gate supports Streamable HTTP. A server that runs as a subprocess inside the image isn’t gated. What it sends out meets the same proxy and allowlist.
Can the agent find the real server URL?
Not from Constle. It is never passed into the sandbox, and validate refuses an allowed_hosts entry that names its host. A server’s own replies can still name it.
Which MCP versions does it speak?
Streamable HTTP, revision 2025-06-18.
MCP tool allowlists (guide) → Require approval for an MCP tool call (guide) → Life of a tool call →
The current source and its signed releases aren’t public yet.