Skip to main content

Compare Mint Guard, Rules, and Middleware

Mint Guard, Rules, and Middleware are not mutually exclusive. They run on the same MCP tool traffic and are designed to work together, so the real question is not which one to pick, it's which set to turn on.

Mint Guard is the baseline, like anti-virus: it needs no configuration and you almost always leave it on. When you have higher-value traffic to protect, you layer Rules or Middleware on top for policy that's specific to you.

Compare at a glance​

Mint GuardRulesMiddleware
What it isA managed policy that scans every call for prompt injection and sensitive dataPatterns you define (keyword, regex, tool name, argument value) with an actionYour own JavaScript on the call: call a service, inspect structure, rewrite content
Applies toMCP gatewayMCP gateway and Agent MonitorMCP gateway and Agent Monitor
ConfigurabilityLow. One toggle; MintMCP tunes the policyMedium. You pick the pattern and the actionMaximum. A sandbox where you can express almost anything
Management overheadNone. MintMCP maintains and updates itLow. You author and maintain each ruleHigher. You write and maintain code
Added latencyMinimalMinimalCan be higher, since it may call external services
ActionsBlock, logFlag, block, ask, mask, Slack alertAllow, block, mask or rewrite arguments and results
Turn it on forEveryday MCP usageA specific pattern that's yours to defineHigh-value traffic that needs custom logic or masking, where you accept some latency
Learn moreMint GuardRulesMiddleware

Choose what to turn on​

Start from the traffic you want to protect and work down. You can land on more than one guardrail: that's the point.

Masking, specifically: to mask a value you can name with a pattern, use a Rule. When the masking needs logic or a DLP service to decide what to redact, use Middleware.

Example use cases​

1. Everyday Gmail and Calendar​

Your team uses Gmail and Calendar MCPs, mostly to read mail and coordinate meetings.

Turn on: Mint Guard only. Emails and invites are external content that can hide instructions aimed at the agent, so the baseline earns its keep by catching prompt injection with nothing to configure. There's no specific value to redact, so you don't need a Rule or Middleware yet.

2. Add an employee-survey source with emails to mask​

The same MCP now also pulls records from an employee-survey store, and each record carries the employee's email. You want the agent to use the records but never see the email address.

Turn on: Mint Guard + a masking Rule. Keep the baseline for injection, and add a Rule that matches the email field and masks it, so the agent gets the record with the address redacted. The pattern is known and simple, so a Rule handles it; you don't need Middleware.

3. High-volume internal analysis that needs PII redaction​

An MCP does heavy data and log analysis over internal business data. You need to prevent data loss with PII redaction driven by your in-house logic, but the data is internal and high volume, so injection risk is low.

Turn on: Rules and/or Middleware. Mint Guard is optional here. Because injection risk is low and volume is high, the baseline scan adds latency and cost for little gain, so you can skip it. Redactions you can express as patterns go in Rules; redaction that needs your own logic or your DLP service goes in Middleware.

4. Per-user entitlements on a finance warehouse​

A finance analytics MCP queries your data warehouse. Before any result reaches the agent, you must call your entitlements service to check the requesting user's row and column permissions, drop columns they aren't cleared for, mask account numbers to the last four digits, and write a signed record to your external SIEM.

Turn on: Middleware (plus Mint Guard if the same server also handles external content). Only Middleware can do this: the decision depends on a live external lookup, it reshapes structured results per user, it applies format-aware masking, and it emits to an outside system. None of that is expressible as a pattern, which is exactly the line between a Rule and Middleware.

Reference: each guardrail in detail​

Detect prompt injection with Mint Guard​

A customer ticket or calendar event can contain instructions intended to redirect an agent. When an MCP tool returns that content, the instructions reach the agent through the tool response. Mint Guard scans tool arguments and responses for prompt injection without requiring you to write detection rules.

In Enforcing mode, Mint Guard blocks high-confidence prompt injection. A blocked request stops before the connector runs; a blocked response is withheld from the agent. In Monitoring mode, it records detections without blocking. Findings for credentials, personal data, and harmful content are logged in either mode.

Mint Guard applies across all MCP servers on the gateway, including servers you add later. Start in Monitoring, review detections, then switch to Enforcing to block calls. See Set the Mint Guard mode.

Match specific content or commands with Rules​

Use Rules when you know the pattern to look for. For example, a regex rule can match a confidential project name in a tool response or an API key with a known format. You choose what happens on a match: flag, block, ask for approval, mask, or send a Slack notification.

With Agent Monitor, rules also apply to coding-agent actions such as Bash commands. A tool arguments rule can match the Bash tool and inspect its command argument to block commands such as kubectl get secrets or gcloud secrets versions access before execution.

Supported actions depend on the agent and hook phase. Use a pre-tool rule to stop a command from running, and check the block and mask support matrix when configuring the action.

See Create a custom rule.

Write custom checks with Middleware​

Use Middleware when a check needs to call another service or process data in ways a pattern cannot express. You write JavaScript that runs while MintMCP processes tool calls, responses, or Agent Monitor hook events. For example, your middleware can:

  • Send a tool response to your own prompt injection model and block it based on the result.
  • Call a data loss prevention (DLP) API and replace sensitive values with its redacted output.
  • Check channel or folder IDs against an allowlist to restrict specific Slack or Google Drive tool calls.

Attach the code to a Virtual MCP, a connector within it, or Agent Monitor hook events. Middleware can allow, block, or rewrite arguments and results; on Agent Monitor, the agent's hook protocol determines which actions take effect.

The starter templates include scanning services and resource allowlists, with the tools and fields each template checks. See Create, test, and attach middleware to adapt one or write your own.