Global
Every agent, every tenant, every tool on the gateway is stopped at once. The blunt instrument for a confirmed incident.
MCP firewall capability
Global Kill Switch
One directive that stops agent tool calls before they reach a tool. The kill switch engages in-process on the gateway itself, so it takes effect without a network round-trip; a single STOP ALL fans the decision out to every node across a federated estate while each node’s local switch still engages immediately.
STOP ALL, from a directive to a denied call
The directive resolves to a scope, engages the local switch inside the gateway process, and every matching tool call is refused before the upstream tool is contacted.
STOP ALL directiveIssued from the console or the admin API. Resolves to a scope, never to an untrusted header.
Scope fan-outGlobal · tenant · agent. The directive selects which calls the switch will match.
Local kill switch engagesIn-process on each gateway. Engage, release, active, and list operate without an HTTP hop.
All matching calls deniedEvery call inside the scope is refused before the tool is touched, and the denial is appended to the hash-chained audit.
Three scopes, one control
The same switch selects how wide the stop reaches. Nothing about the enforcement changes between scopes; only the set of calls it matches.
Tenant
One tenant is halted while the rest of the estate keeps serving. Isolates a compromised or misbehaving workload.
Agent
A single agent identity is frozen. The narrowest scope, for containing one runaway or hijacked agent.
How it behaves across a federated estate
Nodes run inside each cloud, region, or on-prem environment. One control plane governs them all under the golden rule.
The stop fans out
A STOP ALL directive travels down to every node. The control plane pushes policy and directives; it never dials into a node to inspect traffic.
Each node still engages locally
Every node’s own kill switch engages in-process the moment the directive lands, so a node does not depend on a live round-trip to start denying calls.
Telemetry goes up, payloads stay
Nodes report signed counts and hashes that the switch is active. Prompts, arguments, and results never leave the local boundary.
Honest limits
The kill switch is a deterministic stop on the tool-call path, not a promise about the network underneath it.
Policy goes down, telemetry goes up
Directives and policy travel to nodes; nodes push aggregate signed rollups back. Customer payloads never leave the local boundary in either direction.
It stops tool calls, not the model
The switch refuses matching calls at the gateway. It does not reach inside the agent runtime or halt inference; the agent simply cannot act through the gate.
Air-gapped nodes act on their own copy
Where a node cannot reach the control plane, its local switch still engages from the last delivered directive. Signed directive and rollup bundles exchange offline.
No fabricated reach numbers
Fan-out timing depends on your topology and transport. We do not quote a universal propagation figure; each node’s local switch engaging immediately is the guarantee.
Related capabilities
Each control sits on the same MCP firewall decision path. Explore the neighbouring runtime capabilities.