Label MCP servers and tools
See the labels SecureAuth puts on MCP tools, add your own, and match them so one rule covers many tools
Once you add a few MCP servers, naming each tool in a rule stops scaling, and new tools arrive without a rule that covers them. Labels classify MCP servers and tools so a rule can match the label instead. SecureAuth labels most tools for you, and you add your own for what matters to your organization.
Labels SecureAuth applies
Every catalog tool carries one of read-only, write, or destructive, plus external when it reaches outside your organization.
| Label | The tool |
|---|---|
read-only | Reads data without changing anything |
write | Creates or changes data, and the change is reversible or additive |
destructive | Deletes, overwrites, or makes an irreversible change |
external | Sends messages or email, posts publicly, or fetches arbitrary URLs |
For a tool on a custom server, SecureAuth reads the tool's MCP annotations when it first discovers the tool:
| Annotation | Label |
|---|---|
readOnlyHint: true | read-only |
destructiveHint: true | destructive |
destructiveHint: false | write |
openWorldHint: true | external |
SecureAuth assigns these labels once. Later changes to the server's annotations don't change them, and the audit log records each assignment, attributed to System.
Add your own labels
Mark the servers and tools that matter to you, such as finance on the servers that move money or prod on the ones that reach production.
- Open the server from Inventory › Tools & Services.
- Add a label in the server's Tags section, or on one tool with its own Tags control. The tool control also offers the built-in labels, so you can label a tool SecureAuth left unlabeled.
Create and rename labels on Inventory › Labels.
Adding labels needs the manage_tags permission.
See Labels.
Match labels in rules
A rule can match a label on the server or on the tool:
- MCP pill – every server carrying the label
- Tools pill – every tool carrying the label
A rule that matches a label covers every tool that carries it, including tools on servers you add later.
For example, an allow rule on read-only tools lets agents read across every server, and turning off the seeded Allow all rule then denies everything else.
Conditions can test labels too, with mcp.tags and mcp.tool.tags, such as "pii" in mcp.tags.
See Control MCP tool access.
Scope a connection by label
An agent can connect to only the servers and tools that carry the labels you choose.
Add ?tags= to the gateway URL, or pick Tags in the connect dialog.
See Scope a connection.
Check the labels before you rely on them
- Annotations are unverified.
A server sets its own annotations, so a tool marked
readOnlyHint: truemay still change data. Add only servers you trust, and check the labels on their new tools. - Some tools have no built-in label.
A custom-server tool gets none when its server sends no annotations, so a deny rule on
destructivedoesn't cover it. Label it yourself, or allow onlyread-onlytools and rely on the default deny. - Deleting a label changes your rules. An allow rule that matched it stops granting access, and a deny rule stops protecting. The delete dialog lists every rule that matches the label.
Next steps
Your MCP servers and tools now carry labels that rules can match. Next, write a rule that matches one.
- Control MCP tool access – allow or deny tools by server, tool and label
- Labels – label agents too, and filter Agent Trail and analytics by label