CattleGrid

CISO / Head of InfoSec

The stake

DLP and AI governance tooling was built for a single pattern: a prompt goes out, a completion comes back. That pattern still accounts for most AI traffic, and 71% of UK employees are already using AI tools their employer hasn't sanctioned, with 51% doing so weekly (Microsoft/Censuswide UK Shadow AI Survey, October 2025, n=2,003) — so even the pattern the market already governs is under-governed in most organisations.

But the pattern itself has changed. Model Context Protocol and tool-calling mean an agent can now invoke a tool, and that tool's output flows straight back into the model's context — a second data path that most AI governance products, built to inspect prompts and completions, were never architected to see. Every vendor in this category can tell you they govern the model. Almost none can tell you what happens to the data flowing between a tool call and the model that receives its output. That gap is not a minor omission. It is the part of the architecture where ungoverned data re-enters the loop.

What's built, and what isn't yet

CattleGrid's position on this is deliberately precise, because overstating it would be worse than saying nothing.

What's live: taint verdicts on MCP tool-call output, in the Desktop app. When a tool is invoked from CattleGrid Desktop's AI Chat, the result is evaluated and returned with a taint verdict — Pass, Warn, Sanitise, or Block — before it reaches the model. This applies CattleGrid's governance engine to a data path that, everywhere else in the market, currently has none. It is scoped: Desktop app, MCP tool-call output, today. It is not yet coverage of every agent-to-agent hop across every client and provider.

What's live: scoped API-key permissions around MCP and taint data. Management API keys carry fine-grained scopes — `mcp_read`, `mcp_write`, `mcp_admin`, `taint_read`, `taint_write` — so which applications and automations can read or act on MCP connections and taint verdicts is a configuration decision, not an all-or-nothing grant. Combined with OAuth token issuance and revocation for every connected MCP client (Claude Desktop, Cursor, VS Code, and others), you get an auditable record of what's connected, what scope it holds, and when it last authenticated.

What's live: the underlying inspection engine. Layer 1 pattern matching — regex and keyword rules, evaluated in-process in under a millisecond — is what actually runs in production today, across 28 pre-built templates for UK PII, financial data, and credentials, plus any custom rules you configure. Domain-specific detection agents for PII, healthcare, legal, and financial content are specified and interface-ready, but not yet live — treat that as roadmap, not current capability.

What's live: the audit chain underneath all of it. Every inspection decision is written to a record protected by four layers: database triggers that make committed rows immutable, a SHA-256 hash chain linking each row to its predecessor, HMAC-SHA256 signatures using a key held separately from the data, and two automated verification jobs — hash chain checked every 15 minutes, signatures sampled and re-verified hourly. An attacker with database access alone cannot forge a valid signature. This maps directly to ISO 27001 Annex A evidence requirements for access control, audit trail, and incident alerting, and exports to Splunk, Wazuh, and Elastic in CEF, Syslog, NDJSON, or webhook format, with GRC platform connectors for ServiceNow, Archer, MetricStream, and others.

What this looks like once it's in place

You can tell your board, and any client's security due-diligence team, that you're the organisation that identified and started closing the tool-calling governance gap before it became a named vulnerability class — with a specific, verifiable answer for how MCP tool output is evaluated today, and an honest account of what's still in build. That is a materially stronger position than either ignoring the gap or claiming it's already solved.

What CattleGrid does not do

CattleGrid does not currently govern every agent-to-agent hop across all clients and providers — the live taint verdict coverage is scoped to MCP tool-call output inside the Desktop app, not a comprehensive agentic governance layer. Domain-specific detection for PII, healthcare, legal, and financial content is pending deployment; what actually runs today is Layer 1 pattern matching. CattleGrid does not inspect or govern AI response content outside that scope, does not conduct penetration testing or vulnerability assessment, and does not produce ISO 27001 ISMS documentation itself — it generates evidence that supports your own ISMS, not a substitute for it.

Pricing →