---
schema_version: "1"
id: a5cde3d49725989a1dfcdd95837c4f1dc3082613aa2bf0f1f3529ed980dd33c3
title: Configuring MCP Access Control Policies
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-mcp-access-control-together.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-mcp-access-control-together
source_site: docs.mulesoft.com
content_type: documentation
content_hash: ac8add5f480297ef98ce3b95345480169f82b2f78e40e011349406047f32dd21
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
keywords: api gateway, flex gateway, gateway, policy, mcp, access control, tool mapping, abac
---

# Configuring MCP Access Control Policies

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Omni Gateway provides three MCP policies that work together to control which tools and related MCP
entities are exposed:

- [MCP Global Access](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-global-access): Restricts which tools are exposed by
  using allow or block rules.

- [MCP Tool Mapping](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-tool-mapping): Redefines tool names and descriptions to
  reduce prompt complexity and improve LLM comprehension.

- [MCP Attribute-Based Access Control](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-attribute-access-control): Grants each
  client a subset of tools based on who they are, such as Tiers, IP, headers, or claims.

## How the Policies Work Together

You can use MCP policies individually or combine them to fit your use cases. When you use multiple
policies together, stack them in this order from the gateway toward the client so that they work as
intended:

> [!NOTE] If you use
> [MCP Tools Progressive Disclosure](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-progressive-disclosure), it must be
> positioned after the [MCP Support Policy](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-support) but before any other MCP
> access control policies.

MCP Global Access

Filters the overall tool list. Define rules to allow or block specific tools so that only the tools
you want to expose enter your network.

MCP Tool Mapping

Redefines tool names and descriptions to reduce prompt complexity and improve LLM comprehension.
Mapping doesn’t filter tools. If you use both policies, MCP Global Access must allow a tool before
mapping applies.

MCP Attribute-Based Access Control

Grants each connecting client a tailored subset of the available tools based on attributes, such as
tiers, IP addresses, headers, or claims.

To configure the policy order, see [Ordering Policies](https://docs.mulesoft.com/gateway/latest/policies-reorder).

## See Also

- [MCP Global Access](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-global-access)

- [MCP Tool Mapping](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-tool-mapping)

- [MCP Attribute-Based Access Control](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-attribute-access-control)

- [Ordering Policies](https://docs.mulesoft.com/gateway/latest/policies-reorder)

- [Omni Gateway Agent Policies](https://docs.mulesoft.com/gateway/latest/agent-policies)