Harvey introduces the MCP Policy Engine to strengthen AI security for legal workflows, addressing risks like tool poisoning and data vulnerabilities.
Harvey, an AI company specializing in legal and professional services workflows, has announced the development of its Model Context Protocol (MCP) Policy Engine. This innovation aims to enhance security across its platform by addressing vulnerabilities and risks in tool integration and information flow management.
According to a blog post published by Harvey on October 7, 2026, the MCP Policy Engine introduces runtime controls to manage tool access, information flow, and agent actions. This builds on Harvey's existing security measures and responds to threats such as prompt injection and tool poisoning attacks. The company states that these risks are significant for its user base, which spans over 3,000 customers in 70+ countries.
MCP, a reusable standard for tool discovery and interaction, increases the capabilities of AI agents but also expands the attack surface. Specific threats include malicious tool definitions or changes introduced post-approval—a scenario referred to as a "rug-pull attack." Harvey's policy engine mitigates these risks through defense-in-depth strategies, including least privilege restrictions, complete mediation of tool actions, and secure information flow controls.
The company's proactive approach to security includes rigorous reviews of partner MCP integrations, detailed assessments of tool capabilities and risks, and runtime enforcement of security policies. For example, the MCP Policy Engine's "Tool Pinner" tracks and flags changes to approved tools, enabling real-time monitoring for potential vulnerabilities. Additionally, the engine incorporates a "Sanitizer" feature to remove hidden characters or potentially malicious instructions embedded in tool results.
Source link
