Rule Templates

MCPGate ships 33 built-in rule templates organised into 9 categories. Each template is configured with a JSON object — the fields and an example are shown for every template below.

To attach a template to a tool, go to your App → Guardrails tab → click Add Rule on the tool you want to constrain. Select the template type and fill in the configuration.

Guardrail rule editor showing a template being configured — Configuring a rule template in the Guardrails tab.

Text & Content#

keyword_block

Deny tool calls whose string parameters contain any of the specified keywords.

Config fields

keywords: string[]

Example

json

{"keywords": ["confidential", "internal", "secret"]}

content_length

Enforce a maximum character length on string parameters.

Config fields

max_length: number, field?: string

Example

json

{"max_length": 2000}

require_prefix

Require that a specific string field begins with a given prefix.

Config fields

field: string, prefix: string

Example

json

{"field": "subject", "prefix": "[AI]"}

block_pattern

Deny tool calls whose parameters match a regular expression.

Config fields

pattern: string, field?: string

Example

json

{"pattern": "\\b(password|passwd|pwd)\\b", "field": "body"}

Email#

allow_domains

Allow email addresses only from specified domains. Deny all others.

Config fields

domains: string[]

Example

json

{"domains": ["yourcompany.com", "partner.com"]}

block_domains

Block email addresses from specified domains.

Config fields

domains: string[]

Example

json

{"domains": ["competitor.com", "spam-domain.net"]}

allow_addresses

Allow only specific email addresses in recipient fields.

Config fields

addresses: string[]

Example

json

{"addresses": ["[email protected]", "[email protected]"]}

block_addresses

Block specific email addresses from being used as recipients.

Config fields

addresses: string[]

Example

json

{"addresses": ["[email protected]", "[email protected]"]}

max_recipients

Limit the maximum number of recipients in a single email.

Config fields

max: number

Example

json

{"max": 5}

block_external

Block all email addresses that are not in your connected Google Workspace domain.

Config fields

none — uses the domain from the connected account

Example

json

{}

Values & Access#

allow_values

Allow only specific values for a named parameter field.

Config fields

field: string, values: string[]

Example

json

{"field": "channel", "values": ["C01234", "C05678"]}

block_values

Block specific values for a named parameter field.

Config fields

field: string, values: string[]

Example

json

{"field": "status", "values": ["published", "live"]}

protect_values

Redact or mask a specific field in tool call arguments before logging.

Config fields

field: string

Example

json

{"field": "password"}

protect_labels

Prevent adding or removing specific Gmail labels.

Config fields

labels: string[]

Example

json

{"labels": ["IMPORTANT", "STARRED"]}

Data Protection#

pii_detection

Block tool calls that contain personal identifiable information of specified types.

Config fields

types: string[] — options: email, phone_us, ssn, creditcard, ip_address

Example

json

{"types": ["email", "phone_us", "ssn", "creditcard"]}

block_secrets

Block tool calls that appear to contain API keys, tokens, or other secrets based on pattern matching.

Config fields

none — uses built-in secret patterns

Example

json

{}

Deletion#

block_delete

Deny all calls to this tool unconditionally. Use on delete-category tools to prevent any deletion.

Config fields

none

Example

json

{}

protect_age

Block deletion of items newer than a specified age in days.

Config fields

min_age_days: number

Example

json

{"min_age_days": 30}

Messaging#

block_mass_mentions

Block Slack messages containing @channel, @here, or @everyone.

Config fields

none — blocks all mass mention patterns

Example

json

{}

block_links

Block tool calls whose string parameters contain HTTP/HTTPS URLs.

Config fields

none

Example

json

{}

allow_link_domains

Allow URLs only from specified domains. Block all other links.

Config fields

domains: string[]

Example

json

{"domains": ["docs.yourcompany.com", "github.com"]}

Files#

allow_folders

Allow file operations only within specified folder paths.

Config fields

paths: string[]

Example

json

{"paths": ["/AI-Workspace", "/Shared/AI"]}

block_folders

Block file operations in specified folder paths.

Config fields

paths: string[]

Example

json

{"paths": ["/Finance", "/HR", "/Legal"]}

allow_file_types

Allow only specified file extensions in upload or create operations.

Config fields

extensions: string[]

Example

json

{"extensions": [".txt", ".md", ".csv"]}

block_file_types

Block specified file extensions in upload or create operations.

Config fields

extensions: string[]

Example

json

{"extensions": [".exe", ".sh", ".bat", ".ps1"]}

block_overwrite

Block operations that would overwrite an existing file.

Config fields

none

Example

json

{}

Repos#

allow_repos

Allow operations only on specified repositories (owner/repo format).

Config fields

repos: string[]

Example

json

{"repos": ["myorg/frontend", "myorg/backend"]}

block_repos

Block operations on specified repositories.

Config fields

repos: string[]

Example

json

{"repos": ["myorg/infra", "myorg/secrets"]}

protect_branches

Block PR creation or pushes targeting specified branch names.

Config fields

branches: string[]

Example

json

{"branches": ["main", "production", "release"]}

require_labels

Require that issues or PRs include at least one label from a specified set.

Config fields

labels: string[]

Example

json

{"labels": ["bug", "feature", "chore"]}

force_draft

Override the draft parameter to true on all PR creation calls.

Config fields

none

Example

json

{}

Time & Rate#

time_window

Allow tool calls only within specified hours (24h format, UTC).

Config fields

start_hour: number, end_hour: number, timezone?: string

Example

json

{"start_hour": 9, "end_hour": 17, "timezone": "America/New_York"}

cooldown

Enforce a minimum time between calls to this tool.

Config fields

seconds: number

Example

json

{"seconds": 60}