> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcprouter.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and trust boundaries

> Assign authority to the host, not model proposals, MCP metadata or retrieval scores.

# Security and trust boundaries

> **Public documentation preview — incomplete.** The SDK and optional AI SDK peers remain private and unpublished. This guide is not a security certification or substitute for application-owned access controls.

mcprouter is an in-process Node.js SDK, not a hosted security perimeter. The **application** owns identity, network destinations, secrets, model budgets, and any approval workflow. Start with a [synthetic, model-free example](/start/first-call); read [Router outcomes](/reference/results-and-errors) before introducing side effects.

## Grant permission to an exact call

Every executable path goes through the same governed call: validate arguments, resolve a current binding, apply `policy.authorize`, and dispatch only when allowed. `execute` and AI SDK ToolSet calls supply an expected snapshot. For a **direct** `router.call`, `expectedSnapshot` is optional; pass the `schemaHash` and `bindingGeneration` from the current bound descriptor if you require stale-replacement detection. Define `policy.eligibility` for discoverability and `policy.revision` for rule changes. Without a policy, a supported call is denied. Filtering, model preferences, read-only annotations and scores are not grants.

Populate `RequestContext` **only** from authenticated, trusted host state. Check the exact server, original tool name, target resource and arguments against current tenant permissions; do not accept a model-selected customer ID as proof of access. Advance the revision when permissions change. An approval-required outcome does not execute; the host must complete its own explicit approval and revalidation workflow. See [shared policy configuration](/integrate/models-servers-policies).

## Bound network and model exposure

* Treat MCP tool descriptions, schemas and response text as untrusted. Do not construct server URLs, executable commands or model destinations from tool or model output. Use trusted HTTPS endpoints for remote Streamable HTTP, or explicitly provision trusted stdio executables.
* Named model adapters are host-configured objects, not a built-in `{url, key}` provider loader. `modelAccess` restricts model-backed router operations; it does **not** constrain direct AI SDK `generateText` calls. Approve their egress, prompt/schema exposure, logging and spending independently. See [bindings](/integrate/model-bindings) and [AI SDK integration](/integrate/ai-sdk).
* A bound descriptor's schema hash and generation protect against stale replacement **when passed as the expected snapshot**; they are not an automatic check for direct calls that omit it. Filtering raw MCP tool definitions does not register them or make them executable. Refresh/reselect when bindings change, and never substitute a different descriptor after model selection.
* A timed-out or cancelled call may still have unknown post-dispatch effects. `sideEffectState: 'unknown'` is **not** a rollback, and a denied or approval-pending operation is not permission to retry. See [outcomes](/reference/results-and-errors).

The optional AI SDK ToolSet returns full execution results to trusted host code, while its default *model-facing* output includes only status/code/tool ID. Do not log or send raw result payloads to a model by accident. The docs site itself supplies no sandbox or policy for your host's own inference requests.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.