← All posts
By The agentjail team
announcementrelease

Announcing v0.3.0: MCP inventory, per-tool policy

agentjail now inventories every MCP server across your team, enforces policy at the tool level inside MCP servers, and tracks active agent sessions.

v0.3.0 release: MCP inventory, per-tool policy, and session tracking

Three releases landed this week: v0.2.8, v0.2.9, and v0.3.0. Together they close the biggest gap security teams told us about: you had no way to know what MCP servers your devs were running, and no way to control what those servers could do.

Now you do.

MCP inventory: see everything that’s connected

agentjail mcp inventory

This scans every source an MCP server can hide in: agent configs (Claude Code, Codex, Cursor), npm packages, pip packages, and Docker containers. For each server it reports who installed it, when, and what tools it exposes.

Before this, asking “what MCP servers are running across the team?” had no answer. Now it’s one command.

Per-tool MCP policy: block the dangerous tools, not the whole server

The old model was binary: allow or block an entire MCP server. But a GitHub MCP server that can list repos is fine. The same server’s delete_repo tool is not.

v0.2.8 introduced blocked_tools and ask_tools inside policy.yaml:

mcp:
  allowed: ["github"]
  blocked_tools: ["github/delete_repo", "github/transfer_repo"]
  ask_tools: ["github/create_repo"]

Or via CLI:

agentjail mcp tool block github/delete_repo
agentjail mcp tool ask github/create_repo

The server stays connected. The dangerous tools get blocked. The agent keeps working.

Per-project policy: different rules for different repos

Not every project needs the same policy. A payment service should block more than an internal docs site.

v0.2.9 added per-project policy cascading. Global defaults apply everywhere. Per-project overrides narrow or widen them:

projects:
  /path/to/payment-service:
    mcp:
      blocked: ["*"]
      allowed: ["github"]

The web UI got a project selector to manage this visually.

Session tracking: know what’s running right now

v0.3.0 added agentjail sessions list, which shows active and past agent sessions with PID-based detection. Sessions display human-readable names from Claude Code metadata instead of opaque UUIDs.

agentjail sessions list

This uses process tree walking (sysctl on macOS, /proc on Linux) to detect which agent processes are actively running, so you can tell the difference between a session that finished an hour ago and one that’s running right now.

Also in these releases

  • Live MCP tool discovery via MCP protocol introspection with provenance metadata
  • Policy management UI with MCP tool matrix and inline config editor
  • Per-skill policy with agentjail skill allow/block/ask
  • Cobra CLI migration for automatic --help and shell completions
  • Security hardening: XSS, CSRF, credential leak, DOM injection, goroutine safety fixes

Upgrade

agentjail update

Or install fresh:

curl -fsSL https://agentjail.io/install.sh | sh

Full changelog on the changelog page. Source on GitHub.