Govern MCP servers
Sernixa separates three jobs that are easy to confuse: discovering a server, adding it to organizational inventory, and deciding whether a specific tool call may run.
Choose the right path
| Your situation | Product path |
|---|---|
| You already know the server and connection details | Open Add MCP Server and enter it manually. |
| You want to evaluate a catalog candidate | Open MCP Registry, review its source, then start onboarding. |
| You want observations from managed machines | Open Auto Discovery and create a policy-scoped discovery job. |
| You want to govern a proposed tool call | Use the SDK call gate. |
Review before onboarding
For every candidate, confirm:
- source and publisher information;
- the person or team that will own it;
- transport and connection details;
- tools and resources it can expose;
- credentials and data it may access;
- expected environment and network boundary; and
- the policy that should govern its calls.
Importing a catalog candidate creates inventory. It is not an endorsement of third-party software, so use your normal software and vendor review before deployment.
Complete the onboarding flow
The onboarding flow is organized around four decisions:
- Review: confirm provenance, ownership, and intended use.
- Configure: provide environment-specific transport and credential references.
- Validate: inspect the evidence and policy result returned for this configuration.
- Confirm: add the server to managed inventory with the chosen lifecycle and owner.
Do not replace the returned evidence or policy result with a manually invented trust label.
Understand discovery states
| State | What you can conclude |
|---|---|
| Candidate observed | A configured discovery path reported a possible server. |
| Machine enrolled | The machine identity exists in organizational inventory. |
| Accepted sync | Sernixa accepted one discovery payload from that machine. |
| Candidate imported | An administrator added the server to organizational inventory. |
| Validated after change | A later validation or accepted sync observed the expected state. |
Govern tool calls
Onboarding answers what server is this? A call decision answers may this exact tool call proceed now? Your MCP host should send the proposed call to Sernixa, dispatch only after an allowed outcome, and handle the upstream result itself.
Keep policies narrow by server, tool, operation class, data sensitivity, environment, and agent identity.
Next step
Follow Integrate an agent to gate a tool call, or configure Policies and controls for the MCP risk levels your team allows.