Skip to main content
The mcp connection type relays Model Context Protocol traffic as opaque HTTP. That covers data masking in transit. It cannot tell a model calling delete_issue from the same words appearing inside a tool result. The MCP Gateway parses every JSON-RPC message in both directions, which makes a class of controls expressible that a byte relay cannot offer:
  • Tool-level allow and deny lists. Hoop strips denied tools from tools/list before the model sees them, so it never attempts a call you would have blocked.
  • Approval holds on individual tool calls. A matched tools/call parks for human review while the rest of the session keeps working.
  • Rug-pull detection. Hoop fingerprints each tool’s name, description and input schema, then kills or flags the session when a server rewrites one mid-conversation.
  • Sampling and elicitation gating. Hoop denies both by default, so a compromised server cannot drive your LLM or phish your users through its own dialogs.
  • Budgets. Cap calls per session, per-tool rates, and result size.
  • Structured audit. Session review names the tool that ran, its argument digest, how long it took and which rule blocked it, in place of request and response blobs.
Guardrails and data masking still apply, and they now run on the free-text fields MCP has: tool-call arguments, tool descriptions and result text leaves. Masking cannot corrupt the JSON-RPC envelope, and guardrails no longer match against protocol framing, which removes a common source of false positives. Hoop proxies remote MCP servers and local stdio servers. A stdio server runs either on the agent, so you can offer an npx-style server as a shared connection without hosting it yourself, or on each user’s own machine, for servers that need their working tree and their credentials.

​
Choosing between MCP and MCP Gateway

The MCP connection type is a byte-level HTTP relay. Choose it when you need TLS termination, session recording and data masking in front of a remote MCP endpoint. The MCP Gateway connection type parses the protocol. Choose it when you need control that names a tool: allow and deny lists, per-tool approvals, rug-pull detection, budgets, or an audit trail a reviewer can read. Both types can run side by side against the same upstream server, so you can move one connection at a time.

​
Transports

  • streamable-http is the current remote MCP protocol. Set the server URL.
  • sse is the legacy HTTP+SSE protocol, still used by some hosted servers.
  • stdio is a local server the agent spawns as a child process. Supply the command and any environment the child needs.
  • client-stdio is the same command, run on the machine of whoever connects. Inspection still happens in the agent; only the process moves.
Both stdio transports take a command instead of a URL. They differ in one thing: which machine runs it. Choose stdio for a server that is the same for everyone: a hosted API wrapper, a shared database tool. Choose client-stdio for a server that is only useful next to the user: filesystem, git, or anything that should act as that person rather than as a shared service account. Talk to our team if you want to discuss your setup before deploying.