Compare network policy, hooks, EDR, and MCP gateways
Visibility into supported network traffic
Formal Endpoint inspects supported traffic selected by network rules, including model APIs, remote MCP, git, HTTP, and databases. TLS inspection requires client trust in the Formal CA.
Enforcement beyond one harness
Network policy can cover subprocesses and multiple harnesses. Preventing direct access requires managed enforcement, fail-closed behavior, and network rules that cover the relevant paths.
Secrets injected at the proxy
Formal can add configured upstream credentials at the proxy, keeping those secrets out of the agent process.
One control for agents and humans
The same proxy and the same Rego policies cover the agent and the engineer, with different rules for each.
Control points cover different parts of an agent’s work
An agent uses a model, local tools, remote MCP servers, HTTP APIs, and sometimes production databases. Each control point provides different context.
- Hooks can block supported tool invocations before they execute, including Bash commands that launch scripts or network clients.
- EDR monitors host activity and can apply process, file, and network controls. Capabilities and tamper protection vary by product.
- MCP gateways govern calls routed through them. Some support local stdio servers as well as remote HTTP servers.
- Formal parses supported network protocols and applies policies to requests and responses routed through its proxies.
Hooks can enforce policy inside the harness
Claude Code PreToolUse hooks can reject a Bash command or MCP call. Administrators can deploy managed hooks that user and project settings cannot disable. A script launched through Bash is therefore not automatically outside hook enforcement: the hook can block its launch.
Once a script is allowed, the hook does not automatically inspect each socket it opens. Hooks also do not cover other harnesses. Network controls can add inspection of supported downstream traffic, while hooks retain useful context about the requested tool invocation.
EDR protects the host
EDR provides host telemetry and behavioral controls that a network proxy cannot replace. Formal adds protocol-level policies for supported traffic, such as masking a database column or blocking a remote MCP tool call.
MCP transport matters
Remote MCP calls over supported HTTPS connections can be inspected by Formal when network rules route them through the proxy. A local MCP server communicating over stdio does not put its tool calls on the network. Formal does not inspect those local tool messages; it may inspect supported network requests the server subsequently makes.
An MCP gateway can also prevent direct access when the upstream server requires gateway-held credentials or network policy blocks alternate paths. Bypass resistance depends on that deployment, rather than on the gateway category alone.
Configure the enforcement boundary
Formal Endpoint runs on managed devices or sandboxes, and Formal Connector runs in your environment. Configure network rules and TLS trust for the clients and protocols you need to inspect.
Transparent Mode enforcement is optional, and its default failure behavior is open to preserve connectivity. Deployments that must prevent direct access need managed enforcement, fail-closed settings, and network rules covering alternate paths. QUIC and localhost handling also affect coverage. A network proxy does not observe local file operations or stdio messages.
Why teams enforce on the network
- Policy that holds. Network enforcement keeps working when the harness is misconfigured, outdated, or replaced.
- Agents use more than MCP. Formal covers model APIs, git, HTTP, databases, and cloud APIs with the same policies.
- Credentials stay out of reach. Credential injection keeps configured upstream secrets out of the agent process. Local files, session tokens, and returned data still need protection.
- Humans and agents in one place. Security teams use one control for every engineer and every agent.
