Flex Gateway Policies

A²D ships five custom policies for Mulesoft Flex / Omni Gateway that enforce the contracts you design in A²D at runtime — without changing the upstream MCP server or the consuming agent.

Overview

All five policies are written in Rust, compiled to wasm32-wasip1, and distributed via Anypoint Exchange. They share a common shape:

• Single-phase response filter over JSON-RPC tools/list and tools/call.
• Pin source that anchors the trusted contract — either A²D ({baseUrl}/api/platform/{assetId}/mcp/spec) or Anypoint Exchange.
• Evidence emission as structured JSON log lines indexed by Anypoint Analytics, and (when configured) POSTed to A²D so the approver who signed off on the spec sees the runtime regression next to their approval.
• Decision modes of enforce (strip the offending tool), warn (annotate the response), and observe (log only).

The policies are MCP-only — they only apply to API instances of type mcp.

The five policies

Pin source: A²D vs Exchange

The drift and poisoning policies each ship in two variants. The detection logic is identical; only the pin source differs.

• A²D variant. The pin is fetched from {baseUrl}/api/platform/{assetId}/mcp/spec. Best when A²D is already the canonical approval surface for your MCP servers and you want emitted evidence to land in A²D Test Lab next to the original approver.
• Exchange variant. The pin is fetched from {exchange.baseUrl}/exchange/api/v2/assets/{groupId}/{assetId}/{version}/mcp.json. Best when you run entirely inside Anypoint and want zero external dependencies — every decision and every evidence event stays inside the customer’s tenant.

Reference deployment

A reference instance of every policy is running on agent-network-ingress-gw in the Anypoint Sandbox environment of anypoint-cbp-1780648272.

Each policy page lists its proxy path, API instance id, A²D upstream, and a curl recipe to exercise it.

Build, publish, apply

Every policy repository follows the same toolchain.

make setup     # cargo-anypoint 1.9.0 + anypoint-cli-v4
make build     # codegen + cargo build (wasm32-wasip1)
make test      # unit + integration tests
make run       # local Flex Gateway via docker compose
make publish   # publish development snapshot to Exchange
make release   # publish immutable release to Exchange

Once published, attach via Anypoint CLI:

anypoint-cli-v4 api-mgr policy apply \
  --environment Sandbox \
  --groupId <org-id> \
  --policyVersion <asset-version> \
  --configFile policy-config.json \
  <api-instance-id> <policy-asset-id>

The 5 reference instances were applied this way.

Evidence flow

When evidence.reportToA2d=true (A²D variants) or the gateway log stream is wired to Anypoint Analytics (Exchange variants), every decision lands as a structured event:

• descriptor_drift — runtime hash diverged from pin
• unpinned_tool — tool present at runtime, absent from pin
• removed_tool — tool present in pin, absent at runtime
• tool_shadowing — near-name twin of a pinned tool
• prompt_injection_pattern — heuristic match on descriptor text
• version_changed — pin version moved (Exchange version=latest)
• pin_stale / pin_unavailable / spec_unavailable — fetch failures
• scenario_applied / fault_injected — mock-integration only
• shadow_divergence — mock-integration shadow mode only

Events POSTed to A²D land in the policy_evidence table and are surfaced in Test Lab under “Runtime Runs” alongside scheduled-test results.

Next Steps

• MCP Tool Drift Detection (via A²D)
• MCP Tool Drift Detection (Exchange)
• MCP Tool Poisoning Detection (A²D)
• MCP Tool Poisoning Detection (Exchange)
• A²D Mock Integration

All five policies together turn A²D’s approved specs into runtime guarantees.