> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Governance for AI Agents

> See every MCP server and tool call your people's AI agents make (e.g. Claude Code, Codex, Copilot), and allow or block each call before it runs.

<Note>
  MCP Governance is a design partner program. It is not generally available. Ask your Lumos account team or email [leo@lumos.com](mailto:leo@lumos.com) to join.
</Note>

An AI agent running in an employee's session inherits that person's access, and Model Context Protocol (MCP) servers often grant more than a task needs. MCP Governance shows you what your people's agents can reach and enables you to control what they do.

Lumos installs a hook that sees every tool call, records it, and returns allow or deny before the call runs.

## What you see on day one

After you turn on MCP Governance, Lumos shows tool calls as people work.

* **Every MCP server in use.** A server appears the first time someone calls it, including servers no admin approved. Locally added servers live in configuration files on the employee's machine, so no vendor API can enumerate them. Watching the calls is the only way to see them.
* **Not only MCP.** The hook sees every tool the agent runs, so shell commands and file edits are captured alongside MCP calls.
* **A searchable call history.** Narrow to one person's week, one server, or one tool, and chart the volume over time. You can answer "who has been calling this, and how often" without a log export.

## What you control

Set policies that allow or block tool calls before they execute.

* **Allow or deny, per tool.** A policy matches on the MCP server, the tool name, whether the tool reads or writes, the person's email, or the arguments of the call. A server can be open for reads and closed for writes.
* **One click for the common case.** Open a server and select **"Allow reads"** or **"Block writes"**. Lumos writes the policy for you, scoped to that server.
* **Policies are ordered, and the first match wins.** Place a policy where you want it to apply. A block belongs above the allows it is meant to override.
* **The default is Allow.** Nothing blocks until a policy says so. When your policies are in place, set the domain default to **Block**.
* **A blocked call names the policy that stopped it.** The person sees the policy name in the agent transcript they are already reading.

## Ask Albus

Albus, the Lumos AI assistant, reads your call history and helps you build policies.

* **Discover tool call patterns.** Ask which servers your teams actually use, who called a tool last week, or what a spike came from. Albus reads the call history and answers, so you don't need to search through logs.
* **Build policies in plain language.** Describe the rule you want and Albus writes it. Albus uses the servers and tools it already sees in your organization, so the conditions fit your environment rather than a template. It edits and reorders existing policies too. Every change comes back as an approval card before it takes effect.

## What Lumos stores

| Data | Evaluated at runtime | Stored by Lumos |
| - | - | - |
| Server, tool name, and who called it | Yes | Yes |
| Time and the verdict | Yes | Yes |
| Tool call arguments | Yes | Yes (a setting can turn storage off) |
| User prompts | No | No |
| Model responses | No | No |
| Tool call results | No | No |

For general security questions, see [trust.lumos.com](https://trust.lumos.com/).

## Supported agents and clients

| Agent or client | Support | Notes |
| - | - | - |
| Claude Code | Supported today | Visibility and policy enforcement across MCP calls, shell commands, file operations, and other tool calls. Includes Claude Code inside the Desktop app. |
| Codex | Supported today | Same support as Claude Code. |
| Cursor | Coming soon | |
| Claude Cowork | Coming soon | |
| Claude.ai chat | Not supported | Claude.ai chat does not expose the tool-hook interface Lumos requires. |
| ChatGPT | Not supported | ChatGPT does not expose the tool-hook interface Lumos requires. |

## Getting started

Lumos installs a hook that runs in the agent before each tool call and returns allow or deny. To see how it works, read [How hooks work](/mcp-governance-hooks). To roll it out across your fleet, follow the [MCP Governance rollout](/docs/mcp-governance-rollout) guide.

<Steps>
  <Step title="Lumos turns MCP Governance on for your domain">
    Ask your Lumos account team or email [leo@lumos.com](mailto:leo@lumos.com). This is a design partner program, so Lumos enables it per domain.
  </Step>

  <Step title="Initial users install the hook">
    Each user runs one command from [app.lumosidentity.com/mcp/install](https://app.lumosidentity.com/mcp/install). Usage is unaffected until a policy says otherwise.
  </Step>

  <Step title="Open MCP Governance in Lumos">
    Go to [app.lumosidentity.com/mcp\_tool\_usage](https://app.lumosidentity.com/mcp_tool_usage) to view tool calls, then set policies.
  </Step>
</Steps>

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Can you support Claude Desktop and Claude.ai?">
    Lumos supports Claude Code inside the Desktop app. Claude Cowork support is coming soon. Claude.ai chat is not supported because it does not expose the tool-hook interface.
  </Accordion>

  <Accordion title="Can we view and govern custom MCP servers?">
    Yes. Lumos sees and controls every MCP server, including custom and locally added ones, as well as every other tool call made in an agent session.
  </Accordion>

  <Accordion title="What performance impact does Lumos add to tool calls?">
    Lumos runs a policy check before each tool call and targets under 50 milliseconds per check. Agent workflows typically run for many seconds and make multiple tool calls, so the overhead does not affect the user experience.
  </Accordion>

  <Accordion title="Does Lumos see prompts or model output?">
    No. Lumos evaluates and stores the server, tool, caller, time, verdict, and (optionally) tool call arguments. It never sees user prompts or model responses.
  </Accordion>
</AccordionGroup>

## Related

[NHI Security for Cloud Platforms](/nhi-security) covers the identities your company runs in its own infrastructure, such as service principals, IAM roles, and API keys.