Data protection

Frequently asked questions

• How do AI agents leak sensitive data through MCP tool calls?

  AI agents can leak sensitive data through MCP when they pass context they’ve already retrieved. These include customer records, internal documents, account numbers and more that are used as arguments into the next tool call.

  A single user prompt can fan out into a dozen tool calls. For example, an agent querying a CRM, enriching the data with a third-party server, and summarizing a document from SharePoint can expose SSNs, financial identifiers, and confidential content before a human ever sees a response. 

  Barndoor data protection provides the DLP enforcement layer for MCP tool calls. Barndoor MCP Governance sits between every agent and every MCP server it’s allowed to call, and Barndoor data protection runs inline on every tool input and output, applying tokenization, masking, redaction, or blocking per policy before the call continues.

• What is indirect prompt injection in MCP, and how does Barndoor prevent it?

  Indirect prompt injection is when malicious instructions are embedded inside content an agent retrieves such as a document, a ticket, a wiki page that the agent then follows because it can’t distinguish data from instructions. The content comes back from the server, lands in the agent’s context window, and the agent acts on whatever it says. 

  Barndoor MCP Governance runs a transformer-based classifier on every tool output before that content reaches the model, flagging and blocking injection attempts before the agent ever reads them. This is a distinct enforcement layer from what an LLM gateway provides because by the time a prompt injection reaches the model, it’s already inside your context.

• Does an LLM gateway protect data that flows through MCP tool calls?

  No,  an LLM gateway governs what goes to the model and what comes back, but MCP tool calls are a separate traffic surface that an LLM gateway never sees.

  When an agent calls a CRM, queries a data warehouse, or writes to a ticketing system, those requests route directly to the MCP server and bypass the LLM model entirely. 

  Barndoor MCP Governance covers the tool surfaces: every input an agent sends to an MCP server and every output that comes back. Barndoor data protection supports both and uses the same detector classes and transformation options as the Barndoor LLM Gateway so teams don’t maintain two separate sets of rules. For full DLP coverage across an agentic workflow, you need both.

• What transformation options does Barndoor data protection apply to MCP and how do I choose among them?

  Barndoor data protection offers seven transformation options for MCP tool traffic: block, redact, mask, omit, tokenize, alert-only, and allow. Each is suited to a different combination of sensitivity level and whether the receiving server needs to operate on the value.

  The choice comes down to two questions: does the MCP server need the real value to function, and is any transformed version acceptable to pass through at all? If the answer to both is no, block, so the call never leaves Barndoor MCP Governance. 

  If the server needs to match or process on the value, tokenize: the real identifier is swapped for a reversible placeholder before the request leaves your environment, the MCP server runs the lookup against the token, and the original is restored on the way back. 

  If the server doesn’t need the value but the agent needs to know a value was there, redact or mask, redaction replaces it with [REDACTED]. Masking preserves a useful suffix like the last four digits of an SSN. If the field shouldn’t appear at all, omit drops it entirely with no marker. 

  Alert-only passes the content through unchanged but logs the detection, useful early in a rollout when you’re measuring hit rates before turning on enforcement. 

  Allow creates an explicit exception for a server or value pattern that should never generate noise.

  A single policy in Barndoor MCP Governance can apply different transformations to different tools on the same server, scoped by user group or agent identity.