Security Guardrails for PII/PHI Detection & Rate Limiting
Security Guardrails for PII/PHI Detection & Rate Limiting
Introducing two new governance capabilities to Vendia MCP Gateway: Security Guardrails for automated PII/PHI detection and Rate Limiting for fine-grained traffic control. Together, these features give workspace administrators comprehensive tools to enforce data privacy policies and manage resource usage across users and API credentials.
Security Guardrails for PII/PHI Detection
AI agents can retrieve sensitive data from backend systems via MCP tool calls and pass it directly to LLMs or external services — often without any inspection in between.
Guardrail Policies let administrators intercept that traffic, detect sensitive data, and act on it before it leaves the gateway.
How it works:
Each policy pairs one or more classifiers (data types to detect) with an action and a confidence threshold.
- Mask — obscures the detected value before forwarding to the LLM; supports a configurable character length
- Deny — blocks the request entirely
- Notify — flags the event without altering the data
Policies can be enabled or disabled individually without deletion.
Supported Classifiers: Credit Card, Crypto Wallet, Date/Time, Email Address, IBAN Code, IP Address, Location, Medical License, NRP (Nationality/Religion/Political group), Person, Phone Number, URL, US Bank Number, US Driver License, US ITIN, US Passport, US SSN.
Audit Trail Integration
Every guardrail trigger is automatically recorded in the Vendia Audit Trail. Each entry captures:
- Actor, client type, and client name (e.g., Claude via MCP Client)
- Query type and status
- Whether PII was detected, and which classifier matched (e.g., Phone Number)
- Action taken (e.g., Mask)
- Originating workspace
This gives administrators a tamper-evident log across all MCP traffic — useful for SOC 2 and GDPR compliance reporting, incident investigation, and policy tuning.
Responding to PII Detection Events
Every PII detection event emits a Vendia Change Data Event in real-time, enabling automated response workflows downstream. Teams can use these events to trigger actions such as:
- Post Slack notifications when PII is detected in an MCP request
- Upload detection records to an external storage system or data lake
- Make API calls to dynamically create or tighten a guardrail policy
Rate Limiting
Plan capacity, understand adoption, and identify power users. User-level call attribution surfaces which users are driving the most activity across the gateway.
- Workspace hourly limit — hard ceiling on total MCP requests per hour for the entire workspace
- Per-user overrides — custom hourly limits for specific users (e.g., capped at 100 req/hr);
- Per-API credential overrides — custom limits for individual API credentials to limit agent access
Security Guardrails are available in the Free, Pro and Enterprise tiers. For more information visit docs.vendia.com