New post! We built the MCP Policy Engine at Harvey to govern how agents use MCP tools.
Our approach draws on agent security research and treats prompt injection as an information flow control problem. We enforce policies outside the model based on tool capabilities and agent trajectories.
Read "Building Harvey’s MCP Policy Engine" for details on how these runtime controls work, what we’ve learned, and what we’re working on next!