Glossary
Allowlist and denylist
Deterministic rules that permit only listed tools or patterns (allowlist) or forbid listed ones (denylist), regardless of any model’s judgement.
Checks run on our GPUs in Switzerland. Request payloads are not stored.Security
What Allowlist and denylist means
An allowlist permits only what is explicitly listed, such as a set of tools, commands, hosts or email domains, and rejects everything else. A denylist rejects what is listed, such as rm -rf /, DROP DATABASE or a list of production hosts, and permits everything else.
Their strengths are predictability and auditability: the same input always gets the same answer, at essentially zero cost. Their weakness is coverage. Allowlists get too broad over time to stay useful, and denylists miss variants their authors did not anticipate (a different flag order, an alias, a script that does the same thing).
Static rules and a pre-execution guard are complementary. Keep deterministic rules for known-bad patterns and hard boundaries, and use the guard for the long tail of calls that are harmful only in context. MCP Guard should never be the reason to remove a rule that works.
Related terms
How Allowlist and denylist connects to the rest of the vocabulary.