Skip to main content
How to ensure your organization’s MCP traffic routes through governed MCP gateways you set up in MCP Manager. This version covers Claude Enterprise and Cursor. For the strategy behind these steps, see Enterprise Strategy & Lockdown.

​
Step 0: Line up access

You need three kinds of admin. Hand each section to the right person.
  • An admin of each AI client you’re connecting MCP Manager gateways to (e.g., a Claude org Owner, a Cursor team admin)
  • An IT/endpoint admin who controls MDM/GPO and the firewall
  • An MCP Manager admin

​
Claude org admin

Owner: Claude org Owner
Works in: claude.ai admin settings
  1. Claude admin must go to Organization settings → Connectors and remove all direct connectors, so MCP Manager is the only connection.

    Available on Claude Team and Enterprise plans. Members can only use connectors an Owner has enabled.

  2. In the same settings, click Add custom connector and enter the MCP Manager gateway URL(s).

    Each member then connects to the gateway from their own Connectors settings. Get the URL from the gateway’s Connect this gateway menu in MCP Manager.

  3. Turn off public desktop extensions for the org.

    Extensions bundle local MCP servers. This setting follows the account to any device, even personal ones.

  4. If devs use Claude Code: push allowedMcpServers (gateway URL only) with allowManagedMcpServersOnly: true via server-managed settings.

    Match by URL, not server name. Names are just labels users pick. These settings follow the account, so they work on unmanaged devices too.

​
Cursor team admin

Owner: Cursor team admin
Works in: the Cursor dashboard
  1. Cursor admin must go to MCP Configuration in the dashboard and create an MCP allowlist.

    Requires Cursor Enterprise. With no allowlist, people can add any MCP server.

  2. Add the MCP Manager gateway URL(s) as the only allowlist entries.

    Once the allowlist exists, Cursor blocks every server that isn’t on it. Nothing else to disable.

  3. Require SSO for the team.

    Team rules only cover people signed into the team account. SSO keeps everyone on it.

​
IT / endpoint admin

Owner: IT / endpoint admin
Works in: MDM / GPO / firewall — not in Claude or Cursor’s admin areas
These are settings IT pushes to company devices with your device-management tool (Jamf, Intune, Group Policy), plus firewall rules.
  1. Claude Desktop: set isLocalDevMcpEnabled: false and isDesktopExtensionEnabled: false.

    macOS: configuration profile (com.anthropic.claudefordesktop). Windows: Group Policy or Intune registry.

  2. Claude Desktop: set forceLoginOrgUUID so work machines can’t sign into personal Claude accounts.
  3. Cursor: deploy ~/.cursor/permissions.json so the allowlist holds even outside the team account.
  4. Claude Code, stricter option: deploy managed-mcp.json with a fixed server set. An empty set turns MCP off entirely.

    Careful: this file also blocks claude.ai connectors, including your gateway, unless you set allowAllClaudeAiMcps or put the gateway URL in the file itself.

  5. Block unapproved AI clients from installing or running.
  6. Add an EDR alert for AI clients spawning long-running npx, uvx, node, or python processes.

    That’s what a rogue local MCP server looks like. This catches what app control misses.

  7. Allow these MCP Manager domains through your firewall and proxy: all TCP 443, with TLS-inspection exemptions.

    Allowlist by hostname, not IP. The underlying addresses change. Corporate proxies (Zscaler, Netskope, Cisco Umbrella) commonly break the workstation tunnel without the TLS exemption.

  1. Lock sensitive upstream MCP servers to MCP Manager’s static egress IPs.

    Those servers then only accept traffic that came through the gateway. Bypassing it stops working instead of just being against policy. Your static IPs are listed at enterprise/ip-ranges.

​
MCP Manager admin

Owner: MCP Manager admin
Works in: MCP Manager
  1. Connect SSO.
  2. Turn on SCIM so access is granted and revoked automatically as people join and leave.
  3. Set up Teams & Roles so each gateway only reaches the people who need it.
  4. Provision tools allowlist-by-default: expose only the tools each team needs. See Feature Provisioning.
  5. Review connected apps and agents regularly and disable any you don’t recognize.

    Apps appear as users connect, so this is ongoing upkeep, not one-time setup.

  6. Find the kill switches now: MCP Manager can instantly disable a user identity, a connection, or a server. Know where those toggles are before an incident, not during one.

​
Rollout

Owner: Whoever owns the project
  1. Inventory the MCP servers people already use, before blocking anything.

    That inventory is your migration list for the gateway.

  2. Pilot with one gateway, a small server set, and one team before going org-wide. See Safe Rollout Sequence.
  3. Tell people what’s changing before enforcement lands.

    Blocked servers just vanish from their client with no explanation. Say what’s blocked and how to connect to the gateway instead.