> ## Documentation Index > Fetch the complete documentation index at: https://docs.mcpmanager.ai/llms.txt > Use this file to discover all available pages before exploring further. # Azure AI Content Safety > How to connect Azure AI Content Safety to MCP Manager as a custom rule engine: the four harm categories, per-category severity thresholds, the resource endpoint and key setup, size limits, and how its scores become a block or pass on a gateway rule. The **Azure AI Content Safety** template connects Microsoft's text moderation to MCP Manager as a [custom rule engine](https://docs.mcpmanager.ai/features/gateway-rules/custom-rules-engines.md). Azure scores each screened message for **hate, sexual, violence, and self-harm** content. MCP Manager blocks the message when any category reaches the threshold you set for it. Add it from **Rule Engines** → **Add** → **Azure AI Content Safety**. > [!NOTE] > > This page summarizes Azure AI Content Safety so you can decide how to use it with MCP Manager. Microsoft owns the service and changes it over time. Treat the [Azure AI Content Safety documentation](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/overview) as the authoritative source for its categories, limits, regions, and pricing. > [!TIP] > > Azure AI Content Safety and [Azure Prompt Shields](https://docs.mcpmanager.ai/features/azure-prompt-shields.md) run on the **same Azure resource** and use the **same key**. Content Safety looks for harmful content; Prompt Shields looks for prompt-injection and jailbreak attacks. You can add both as separate engines and attach each to its own rule. ## What it detects Azure scores every message in four harm categories: | Category | Covers, in summary | | - | - | | **Hate** | Attacks on or discrimination against people based on identity, such as race, religion, gender, or disability. | | **Sexual** | Sexually explicit content, sexual violence, and related material. | | **Violence** | Content that describes, praises, or gives instructions for physical harm, including weapons. | | **Self-harm** | Content about hurting or killing oneself. | For each category Azure returns a severity score: **0** (safe), **2** (low), **4** (medium), or **6** (high). For Microsoft's full definitions, see [Harm categories](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/harm-categories). > [!WARNING] > > The classifier is probabilistic. It can miss severe content and it can flag harmless content. Use it as one layer of screening, not as a guarantee. ## Choosing a threshold for each category Under **Sensitivity selection** in the engine form, you set one threshold per category. A message is blocked when **any** category reaches its threshold. | Threshold | Blocks scores of | What it means in practice | | - | - | - | | **Off** | Nothing | Never block this category. | | **High** | 6 | Only the most severe content, such as extremist propaganda, incitement, or endorsement of serious harm. | | **Medium and worse** (default) | 4 and 6 | Also graphic depictions, bullying, insults, and instructions for harm. Opinions, fiction, and mild content pass. | | **Low and worse** | 2, 4 and 6 | Also prejudiced opinions, fiction, and personal experiences that touch the category. This blocks a lot of ordinary business text. | Each category starts at **Medium and worse**. Start there, use **Warn only** (see below) to see what it would block on your real traffic, and then adjust. > [!NOTE] > > MCP Manager's labels say what gets blocked. Microsoft's own documentation describes the same settings the other way round ("Low" is least restrictive), so take care when you compare the two. ## What you need from Azure **1. Create a Content Safety resource** In the Azure portal, create an **Azure AI Content Safety** resource ([create one here](https://aka.ms/acs-create)). If you already have one for [Azure Prompt Shields](https://docs.mcpmanager.ai/features/azure-prompt-shields.md), reuse it. **2. Copy the endpoint and a key** Open the resource and go to **Keys and Endpoint**. Copy the **Endpoint**, which looks like `https://.cognitiveservices.azure.com/`, and **KEY 1** or **KEY 2**. > [!WARNING] > > Use the resource endpoint on `*.cognitiveservices.azure.com`. The regional endpoint (`.api.cognitive.microsoft.com`) is **not supported**, because it does not accept a resource key. MCP Manager rejects it when you save. ## Connecting it in MCP Manager In the **Azure AI Content Safety** rule-engine form, enter: * **Resource endpoint** — the endpoint you copied. The resource name alone (for example `my-resource`) also works. * **Hate, Sexual, Violence and Self-harm thresholds** — see [Choosing a threshold](#choosing-a-threshold-for-each-category). * **Azure key** — KEY 1 or KEY 2. MCP Manager sends it in the `Ocp-Apim-Subscription-Key` header. You don't enter the endpoint URL or the HTTP method. MCP Manager builds the URL from the resource name and fixes the method to POST: ```text theme={null} https://.cognitiveservices.azure.com/contentsafety/text:analyze?api-version=2024-09-01 ``` ### How the key is protected * The key is stored **encrypted at rest**. Only the gateway reads it, when it makes a call. * Before every call, the gateway checks that the URL is exactly this Azure endpoint. The key is never sent anywhere else, and the gateway does not follow redirects. * If you change the endpoint later, MCP Manager asks you to enter the key again. A stored key never moves to a new endpoint. * MCP Manager authenticates with a resource key. Microsoft Entra ID tokens are not supported. ## How it behaves as a rule Once saved, the engine appears in the **Detection method** dropdown on any gateway rule. It pre-selects the **response** direction, which screens tool results before they reach the client. You can also use it on the **request** direction to screen tool call arguments. | Azure result | What MCP Manager does | | - | - | | Every category is below its threshold | **Pass** — the message continues unchanged. | | One or more categories reach their threshold | **Block** — the call never reaches the server, or the result never reaches the client. The alert and [logs](https://docs.mcpmanager.ai/features/viewing-logs.md) name each flagged category and its score, for example `Violence (severity 4)`. | | Nothing to screen (empty arguments or result) | **Pass**, without calling Azure. | | Azure is unreachable, returns an error, or returns a response MCP Manager can't read | Handled by the rule's [failure mode](https://docs.mcpmanager.ai/features/gateway-rules/overview.md#failure-mode-what-happens-when-a-detection-method-fails). The default is **Block**. Azure's error code and message appear on the alert. | Azure AI Content Safety only scores text. It never rewrites it, so it never **modifies** a message. To try your thresholds on real traffic before you enforce them, set the rule's **On detection** to **Warn only**. The call then goes through unchanged, and you get an alert that shows what would have been blocked. See [On detection: enforce or warn only](https://docs.mcpmanager.ai/features/gateway-rules/overview.md#on-detection-enforce-or-warn-only). You can also [test](https://docs.mcpmanager.ai/features/gateway-rules/custom-rules-engines.md#testing-an-engine) the engine with sample text before you attach it to a gateway. ## Size limit Azure screens at most **10,000 characters** (Unicode code points) per call. When a tool call's arguments or a tool result is longer, MCP Manager does not send it. The rule's **failure mode** decides what happens instead, so with the default **Block** an oversized message is blocked. **Warn only** does not change this: it applies to detections, not to messages the engine could not screen. > [!NOTE] > > When a tool result holds JSON as text, MCP Manager screens the decoded values. If the decoded form is over the limit but the original text fits, MCP Manager screens the original text instead. ## Cost Content Safety calls are billed by **Microsoft Azure** on your Content Safety resource, under Azure's pricing. Each screened tool call or tool result is one call. See [Azure AI Content Safety pricing](https://azure.microsoft.com/en-us/pricing/details/cognitive-services/content-safety/) for current rates and the free tier. > [!NOTE] > > MCP Manager does **not** meter or charge per call for routing traffic to Azure AI Content Safety, as long as your plan includes custom rule engines. ## Further reading > **[Azure Prompt Shields](https://docs.mcpmanager.ai/features/azure-prompt-shields.md)** > > Detect prompt-injection and jailbreak attacks with the same Azure resource. > **[Google Model Armor](https://docs.mcpmanager.ai/features/google-model-armor.md)** > > A managed alternative with responsible-AI filters and PII detection. > **[Custom Rule Engines](https://docs.mcpmanager.ai/features/gateway-rules/custom-rules-engines.md)** > > How custom engines are added, tested, and applied to gateway rules. > **[Gateway Rules Overview](https://docs.mcpmanager.ai/features/gateway-rules/overview.md)** > > Detection methods, hooks, failure modes, actions, and rule ordering. ## External sources > **[Azure AI Content Safety overview](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/overview)** > **[Harm categories and severity levels](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/harm-categories)** This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.