> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpmanager.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Enterprise Lockdown Checklist

> How to ensure your organization's MCP traffic routes through governed MCP gateways you set up in MCP Manager.

How to ensure your organization's MCP traffic routes through governed MCP gateways you set up in **MCP Manager**. This version covers Claude Enterprise and Cursor. For the strategy behind these steps, see [Enterprise Strategy & Lockdown](/deployment/enterprise-strategy-and-lockdown).

## Step 0: Line up access

You need three kinds of admin. Hand each section to the right person.

* An **admin of each AI client** you're connecting MCP Manager gateways to (e.g., a Claude org Owner, a Cursor team admin)
* An **IT/endpoint admin** who controls MDM/GPO and the firewall
* An **MCP Manager admin**

## Claude org admin

<Info>
  **Owner:** Claude org Owner<br />
  **Works in:** claude.ai admin settings
</Info>

1. Claude admin must go to **Organization settings → Connectors** and remove all direct connectors, so MCP Manager is the only connection.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Available on Claude Team and Enterprise plans. Members can only use connectors an Owner has enabled.</p>

2. In the same settings, click **Add custom connector** and enter the MCP Manager gateway URL(s).

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Each member then connects to the gateway from their own Connectors settings. Get the URL from the gateway's **Connect this gateway** menu in MCP Manager.</p>

3. Turn off public desktop extensions for the org.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Extensions bundle local MCP servers. This setting follows the account to any device, even personal ones.</p>

4. If devs use Claude Code: push `allowedMcpServers` (gateway URL only) with `allowManagedMcpServersOnly: true` via server-managed settings.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Match by URL, not server name. Names are just labels users pick. These settings follow the account, so they work on unmanaged devices too.</p>

## Cursor team admin

<Info>
  **Owner:** Cursor team admin<br />
  **Works in:** the Cursor dashboard
</Info>

1. Cursor admin must go to **MCP Configuration** in the dashboard and create an MCP allowlist.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Requires Cursor Enterprise. With no allowlist, people can add any MCP server.</p>

2. Add the MCP Manager gateway URL(s) as the only allowlist entries.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Once the allowlist exists, Cursor blocks every server that isn't on it. Nothing else to disable.</p>

3. Require SSO for the team.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Team rules only cover people signed into the team account. SSO keeps everyone on it.</p>

## IT / endpoint admin

<Info>
  **Owner:** IT / endpoint admin<br />
  **Works in:** MDM / GPO / firewall — not in Claude or Cursor's admin areas
</Info>

These are settings IT pushes to company devices with your device-management tool (Jamf, Intune, Group Policy), plus firewall rules.

1. Claude Desktop: set `isLocalDevMcpEnabled: false` and `isDesktopExtensionEnabled: false`.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>macOS: configuration profile (`com.anthropic.claudefordesktop`). Windows: Group Policy or Intune registry.</p>

2. Claude Desktop: set `forceLoginOrgUUID` so work machines can't sign into personal Claude accounts.

3. Cursor: deploy `~/.cursor/permissions.json` so the allowlist holds even outside the team account.

4. Claude Code, stricter option: deploy `managed-mcp.json` with a fixed server set. An empty set turns MCP off entirely.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>**Careful:** this file also blocks claude.ai connectors, including your gateway, unless you set `allowAllClaudeAiMcps` or put the gateway URL in the file itself.</p>

5. Block unapproved AI clients from installing or running.

6. Add an EDR alert for AI clients spawning long-running `npx`, `uvx`, `node`, or `python` processes.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>That's what a rogue local MCP server looks like. This catches what app control misses.</p>

7. Allow these MCP Manager domains through your firewall and proxy: all TCP 443, with TLS-inspection exemptions.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Allowlist by hostname, not IP. The underlying addresses change. Corporate proxies (Zscaler, Netskope, Cisco Umbrella) commonly break the workstation tunnel without the TLS exemption.</p>

| Domain                    | What it is                                                               |
| ------------------------- | ------------------------------------------------------------------------ |
| `app.mcpmanager.ai`       | Main server: the app, MCP gateway, admin MCP server, custom rule engines |
| `gateway.mcpmanager.ai`   | Supporting back-office server                                            |
| `headscale.mcpmanager.ai` | Workstation tunnel coordination. Without it the tunnel never starts      |
| `derp-a.mcpmanager.ai`    | Relay server. Carries workstation tunnel traffic                         |
| `derp-b.mcpmanager.ai`    | Relay server, second region, for failover and latency                    |

8. Lock sensitive upstream MCP servers to MCP Manager's static egress IPs.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Those servers then only accept traffic that came through the gateway. Bypassing it stops working instead of just being against policy. Your static IPs are listed at [enterprise/ip-ranges](https://app.mcpmanager.ai/enterprise/ip-ranges).</p>

## MCP Manager admin

<Info>
  **Owner:** MCP Manager admin<br />
  **Works in:** MCP Manager
</Info>

1. Connect [SSO](/enterprise/sso).

2. Turn on [SCIM](/enterprise/scim) so access is granted and revoked automatically as people join and leave.

3. Set up [Teams & Roles](/deployment/teams) so each gateway only reaches the people who need it.

4. Provision tools allowlist-by-default: expose only the tools each team needs. See [Feature Provisioning](/features/feature-provisioning).

5. Review connected [apps and agents](/mcp-gateway-concepts/apps-and-agents) regularly and disable any you don't recognize.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Apps appear as users connect, so this is ongoing upkeep, not one-time setup.</p>

6. Find the kill switches now: MCP Manager can instantly disable a user identity, a connection, or a server. Know where those toggles are before an incident, not during one.

## Rollout

<Info>
  **Owner:** Whoever owns the project
</Info>

1. Inventory the MCP servers people already use, before blocking anything.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>That inventory is your migration list for the gateway.</p>

2. Pilot with one gateway, a small server set, and one team before going org-wide. See [Safe Rollout Sequence](/deployment/safe-rollout-sequence).

3. Tell people what's changing before enforcement lands.

   <p style={{ fontSize: '0.875rem', opacity: 0.65, borderLeft: '2px solid currentColor', paddingLeft: '0.6rem', marginTop: '0.35rem' }}>Blocked servers just vanish from their client with no explanation. Say what's blocked and how to connect to the gateway instead.</p>