The fair question from every security review: can a third party really sit between a closed agent and the world? The answer depends on the surface, so here it is surface by surface, checked against each vendor's own documentation on the date above. Where we cannot reach, the table says so.
What this map is for. Ripcord gates actions on your systems: payments, records, sends, deploys. Browsing inside a vendor's sandbox is not the threat model; the wire to your ERP is. An agent that reads and clicks all day touches your company only when it presents a key to one of your systems, and that is the moment the table is about.
The Model Context Protocol is not a lab's property. The specification sits under the Linux Foundation's Agentic AI Foundation, licensed Apache-2.0, governed by named individuals rather than company seats, with Anthropic, OpenAI, Google, Microsoft and AWS as platinum members. Every major agent ships an MCP client. What matters for gating is who configures the servers an agent calls: the customer, in a config file or an admin console, never the lab. Ripcord's proxy stands in front of the server the customer configured, on every tool call, whichever model is inside. The July 2026 revision of the protocol even added routing headers designed for intermediaries.
What no protocol gives us: the agents' built-in tools (a coding agent's shell and file edits), the vendors' first-party connectors (called inside the vendor's own cloud), and clicks (browser and computer use). For the built-in tools, the agents' own hook systems are the way in, and the table shows which ones exist.
Four rungs of control, from the proxy to the admin. A tick means it works today; a tilde means it works with a caveat named in the cell; a cross means we cannot see it and say so.
| Agent | MCP tool calls the proxy, today |
Their built-in paths shell, files, first-party connectors |
Hold for a human before execution |
Clicks browser and computer use |
Fleet-wide enforced by an admin |
|---|---|---|---|---|---|
| Claude Code Anthropic · CLI, IDE, desktop, web | ✓stdio and HTTP servers; org allowlists and a managed server list | ✓PreToolUse hook on Bash, Edit, Write, WebFetch, Agent and every MCP tool | ✓the hook can answer allow, deny or ask | ✓browser and desktop control are themselves MCP servers, so the same rules apply | ✓managed hooks, managed-hooks-only lock, server allowlists |
| Cursor IDE and cloud agents | ✓enterprise allowlist by command or URL pattern | ✓beforeShellExecution and beforeMCPExecution; file writes deny-only | ✓ask on shell and MCP calls | ~browser tool is MCP-based; hook coverage not documented | ✓team hooks from the dashboard or MDM |
| Codex CLI OpenAI · CLI and IDE extension | ✓identity-matched server allowlist | ✓PreToolUse on Bash, apply_patch and MCP: deny or rewrite | ~no ask in the hook yet; the hold comes from approval policy | ✗browser and computer use live in the desktop app, not the CLI | ✓requirements.toml: managed hooks, pinned policies |
| Gemini CLI Google · CLI | ✓mcp.allowed at system level | ✓BeforeTool hook on shell, files, web and MCP: deny or rewrite | ~ask only through a static policy rule, not from the hook | ~experimental browser agent; hook coverage not documented | ✓admin policy tier overrides everything |
The enterprise tiers sell permissions, roles, confirmation dialogs and audit logs for their own agent. Those are real, and they are the authorize and contain layers of the map, one vendor at a time. None of them prices an action by expected loss, routes a hold to the owner of the consequence, keeps the action reversible, or keeps a record across vendors. That is the layer beneath them, and it is reachable wherever the customer can add a connector.
| Product | MCP tool calls the proxy, today |
Their built-in paths shell, files, first-party connectors |
Hold for a human before execution |
Clicks browser and computer use |
Fleet-wide enforced by an admin |
|---|---|---|---|---|---|
| Claude Cowork and Claude for Enterprise Anthropic · desktop and web agents | ✓custom remote connector added by an org owner; per-tool always-allow, needs-approval or blocked | ✗Anthropic's own connectors run server-side and never cross a customer MCP | ~inference hooks can deny the next model turn after seeing a tool call; no hold before execution | ✗built-in browser, Chrome and desktop control are out of reach | ✓owner controls, OpenTelemetry stream of every tool call and approval |
| ChatGPT Enterprise and ChatGPT Work OpenAI · web, desktop, workspace agents | ✓admin-published custom MCP app, tool snapshot, per-action toggles | ✗first-party apps for Drive, Outlook, Teams and the rest stay inside OpenAI | ~none in the cloud beyond OpenAI's own auto-review; desktop hooks can deny or rewrite | ✗cloud browser and computer use are not interceptable | ✓managed configuration, roles, lockdown mode |
| Microsoft Copilot Studio, Agent 365, Copilot Cowork Microsoft 365 and Power Platform | ✓Ripcord as an MCP server, or bring-your-own through the Agent 365 tooling gateway | ✗Power Platform connectors and Graph actions never traverse MCP | ✗approval is Microsoft's own UI; no third-party pre-action hook | ✗computer-use tool with human supervision, not interceptable | ✓DLP can block every other MCP server at server level |
| Google Gemini Enterprise and Agent Platform Google Cloud | ✓custom MCP server after an org-policy change, or registry plus Agent Gateway | ✗first-party connector actions bypass the gateway, by Google's own statement | ✓Agent Gateway service extensions can inspect, modify or block gateway traffic before delivery | ✗computer use runs in the developer's harness | ✓org policies, IAM on agent identity |
Several agents now run in a virtual machine the vendor hosts, with a browser inside: ChatGPT's agent mode, Cowork's cloud mode. Nothing anyone installs sees a click in there, and we say so. What we control is the edge of the sandbox, where the agent needs authority to act on your systems.
Two things this does not cover, said plainly: an agent reading and exfiltrating through a human's session, which is identity and data-loss-prevention territory, and an employee who logs an agent in with their own password, which agent identity standards exist to make visible.
AIR, Noma, Zenity, Astrix and Operant vet what an agent is allowed to load: skills, plug-ins and MCP servers, discovered across the company and re-checked as they change. That is the supply chain, and it is worth having. Ripcord gates what the agent does with what it loaded: an approved, vetted MCP server still needs someone to say yes to the $48,200 wire, a rollback window when it was wrong, and a ledger the auditor accepts. Security stops the attacker; Ripcord stops the loss, whether the agent was poisoned, prompted or simply wrong. The two layers stack, and a vendor's vetting verdict is a signal in our scorecard, the way a new beneficiary is.
Hooks for Claude Code and Cursor, so shell and file actions get the same verdict as tool calls; both expose a pre-tool hook that can ask. Agent identity: the Enterprise-Managed Authorization extension of MCP, Okta's cross-app access and Microsoft's Entra Agent ID put the identity provider in charge of which agent may reach which server; Ripcord plugs in as the per-call decision those systems do not make. Destination-side gating: Ripcord as the approver behind Stripe Issuing authorization requests and the card networks' agent mandates, so the verdict applies wherever the money moves, whatever sandbox the agent sits in. The standard itself: an MCP working group is drafting "interceptors," a protocol-level hook for exactly this layer. We are following it and will implement the day it lands.
Governance and spec: modelcontextprotocol.io/community/governance · Linux Foundation, Agentic AI Foundation · spec 2026-07-28 changelog · interceptors working group · enterprise-managed authorization
Coding agents: Claude Code hooks · Claude Code managed settings · Cursor hooks · Cursor MCP · Codex hooks · Codex managed configuration · Gemini CLI hooks · Gemini CLI policy engine
Sandboxes, identity and money: ChatGPT agent · Cowork on Team and Enterprise · Okta Agent SSO · Stripe Issuing real-time authorizations · Agentic Commerce Protocol · Visa Intelligent Commerce Connect
Enterprise and desktop: Claude inference hooks · Cowork release notes · ChatGPT custom MCP apps · ChatGPT agent approvals · Copilot Studio MCP · Entra Agent ID · Google Agent Gateway · Okta cross-app access
Every cell was checked on 4 September 2026. Vendors move quickly; if a row is out of date, tell us and we will re-verify it. Our own protocol position and the score derivation live on the score page; the audit mapping on the compliance page.