Skip to main content
The Azure AI Content Safety template connects Microsoft’s text moderation to MCP Manager as a custom rule engine. Azure scores each screened message for hate, sexual, violence, and self-harm content. MCP Manager blocks the message when any category reaches the threshold you set for it. Add it from Rule Engines → Add → Azure AI Content Safety.
This page summarizes Azure AI Content Safety so you can decide how to use it with MCP Manager. Microsoft owns the service and changes it over time. Treat the Azure AI Content Safety documentation as the authoritative source for its categories, limits, regions, and pricing.
Azure AI Content Safety and Azure Prompt Shields run on the same Azure resource and use the same key. Content Safety looks for harmful content; Prompt Shields looks for prompt-injection and jailbreak attacks. You can add both as separate engines and attach each to its own rule.

​
What it detects

Azure scores every message in four harm categories: For each category Azure returns a severity score: 0 (safe), 2 (low), 4 (medium), or 6 (high). For Microsoft’s full definitions, see Harm categories.
The classifier is probabilistic. It can miss severe content and it can flag harmless content. Use it as one layer of screening, not as a guarantee.

​
Choosing a threshold for each category

Under Sensitivity selection in the engine form, you set one threshold per category. A message is blocked when any category reaches its threshold. Each category starts at Medium and worse. Start there, use Warn only (see below) to see what it would block on your real traffic, and then adjust.
MCP Manager’s labels say what gets blocked. Microsoft’s own documentation describes the same settings the other way round (“Low” is least restrictive), so take care when you compare the two.

​
What you need from Azure

1

Create a Content Safety resource

In the Azure portal, create an Azure AI Content Safety resource (create one here). If you already have one for Azure Prompt Shields, reuse it.
2

Copy the endpoint and a key

Open the resource and go to Keys and Endpoint. Copy the Endpoint, which looks like https://<resource>.cognitiveservices.azure.com/, and KEY 1 or KEY 2.
Use the resource endpoint on *.cognitiveservices.azure.com. The regional endpoint (<region>.api.cognitive.microsoft.com) is not supported, because it does not accept a resource key. MCP Manager rejects it when you save.

​
Connecting it in MCP Manager

In the Azure AI Content Safety rule-engine form, enter:
  • Resource endpoint — the endpoint you copied. The resource name alone (for example my-resource) also works.
  • Hate, Sexual, Violence and Self-harm thresholds — see Choosing a threshold.
  • Azure key — KEY 1 or KEY 2. MCP Manager sends it in the Ocp-Apim-Subscription-Key header.
You don’t enter the endpoint URL or the HTTP method. MCP Manager builds the URL from the resource name and fixes the method to POST:

​
How the key is protected

  • The key is stored encrypted at rest. Only the gateway reads it, when it makes a call.
  • Before every call, the gateway checks that the URL is exactly this Azure endpoint. The key is never sent anywhere else, and the gateway does not follow redirects.
  • If you change the endpoint later, MCP Manager asks you to enter the key again. A stored key never moves to a new endpoint.
  • MCP Manager authenticates with a resource key. Microsoft Entra ID tokens are not supported.

​
How it behaves as a rule

Once saved, the engine appears in the Detection method dropdown on any gateway rule. It pre-selects the response direction, which screens tool results before they reach the client. You can also use it on the request direction to screen tool call arguments. Azure AI Content Safety only scores text. It never rewrites it, so it never modifies a message. To try your thresholds on real traffic before you enforce them, set the rule’s On detection to Warn only. The call then goes through unchanged, and you get an alert that shows what would have been blocked. See On detection: enforce or warn only. You can also test the engine with sample text before you attach it to a gateway.

​
Size limit

Azure screens at most 10,000 characters (Unicode code points) per call. When a tool call’s arguments or a tool result is longer, MCP Manager does not send it. The rule’s failure mode decides what happens instead, so with the default Block an oversized message is blocked. Warn only does not change this: it applies to detections, not to messages the engine could not screen.
When a tool result holds JSON as text, MCP Manager screens the decoded values. If the decoded form is over the limit but the original text fits, MCP Manager screens the original text instead.

​
Cost

Content Safety calls are billed by Microsoft Azure on your Content Safety resource, under Azure’s pricing. Each screened tool call or tool result is one call. See Azure AI Content Safety pricing for current rates and the free tier.
MCP Manager does not meter or charge per call for routing traffic to Azure AI Content Safety, as long as your plan includes custom rule engines.

​
Further reading

Azure Prompt Shields

Detect prompt-injection and jailbreak attacks with the same Azure resource.

Google Model Armor

A managed alternative with responsible-AI filters and PII detection.

Custom Rule Engines

How custom engines are added, tested, and applied to gateway rules.

Gateway Rules Overview

Detection methods, hooks, failure modes, actions, and rule ordering.

​
External sources

Azure AI Content Safety overview

Harm categories and severity levels