---
id: verify-mcp-allowlist
track: coding
version: 0.6.1
label: blocks
keyword: block
where: command write turn-end
sha256: 50570fb79e7a8a61896c3cd88b36e4b5dc3418d826c51cefd7de0891ea31f7a7
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/verify-mcp-allowlist
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Verify MCP Allowlist

verify-mcp-allowlist · version 0.6.1

Blocks — Refuses a matched shell command before it runs. Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)



## What it does

Gates MCP servers against .chock/mcp-allowlist.json, empty by default (name, launcher with exact args, or url host). Shell guard refuses \`\<agent\> mcp add\` and shell writes of MCP configs or the allowlist unless listed. Script gate (commit, tool use, turn end) reads 13 client configs: a server off the list, or with other command, args or url host, refuses; unpinned or shell launchers, http, literal credentials, old versions only warn. Misses: aliases, scripts, gitignored files, other clients.

## Its label on each agent

- Claude Code (tested): Blocks — Refuses a matched shell command before it runs. Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=verify-mcp-allowlist
- Cursor (tested): Blocks — Refuses a matched shell command before it runs. Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=cursor&p=verify-mcp-allowlist
- Codex (tested): Blocks — Refuses a matched shell command before it runs. Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=verify-mcp-allowlist
- GitHub Copilot (tested): Blocks — Refuses a matched shell command before it runs. Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=verify-mcp-allowlist
- Devin (tested): Blocks — Refuses a matched shell command before it runs. Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=verify-mcp-allowlist
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=verify-mcp-allowlist
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=verify-mcp-allowlist
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=verify-mcp-allowlist
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=verify-mcp-allowlist
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=verify-mcp-allowlist
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=verify-mcp-allowlist

## What it misses

Aliases, scripts, gitignored files, other clients.

## Examples

- Refused: An agent writes .mcp.json naming a server that is not on the allowlist. — `tee .mcp.json <<'EOF'
{"mcpServers": {"evil": {"command": "npx", "args": ["-y", "evil-mcp-server@1.0.0"]}}}
EOF`
- Allowed: An agent reads the MCP config and the allowlist. — `cat .mcp.json .chock/mcp-allowlist.json`

## Latest change

0.6.1 · 2026-10-26 — Lint, no behaviour change: the printf argument count of the whole-text form is a named constant.

## Provenance

- Tested by 116 of 116 cases run automatically
- SHA-256: `50570fb79e7a8a61896c3cd88b36e4b5dc3418d826c51cefd7de0891ea31f7a7`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/verify-mcp-allowlist (catalog path `base/verify-mcp-allowlist`)
- Presets: none
- JSON: `/api/coding/policies/verify-mcp-allowlist.json`
- Report a problem: https://chock.sh/report/?policy=verify-mcp-allowlist&version=0.6.1&page=%2Fcoding%2Fpolicies%2Fverify-mcp-allowlist%2F