MCP Fail-Open vs Fail-Closed: Choosing Your Enforcement Posture
Every policy-enforcing system has an uncomfortable question buried in it: what happens when the policy itself can’t be read? Databases have slow moments; networks blip. At that instant a tool call is in flight and the gateway must choose without the rulebook: deny the call (fail closed — safe, but your agents stall on infrastructure hiccups) or allow it (fail open — smooth, but a policy gap during the blip).
There is no universally right answer — it depends on the server. A production database connector and an internal docs search deserve different answers. That’s why MCP Trail makes it an explicit, per-server setting called enforcement posture, with three options — and one guarantee that never varies: authentication is always enforced. No posture ever lets an unauthenticated call through; posture only governs policy decisions when the policy store is unreadable.
The three postures
- Strict (fail-closed) — block on doubt. If a policy can’t be read, the call is denied. The default, and the right choice for servers with destructive or sensitive tools: a rare stall is cheaper than one unpoliced delete.
- Resilient (fail-open) — never get in the way. If a policy can’t be read, the call is allowed and audited. Right for low-risk, availability-critical servers — read-only search, docs, lookups — where blocking productivity over a database blip is the worse failure.
- Observe-only — policy decisions (allow / deny / approve) are logged, not enforced — while DLP, rate limits, and payload limits still apply. This is an onboarding and canary mode: see exactly what your policies would do to real traffic before any of them can block anything.
Step 1: Create your free MCP Trail account and add a server
Sign up at app.mcptrail.com and route your server through the gateway. It starts in Strict — protected by default.
Step 2: Set the posture per server
Open the server under Guardian servers → Security tab → Request limits, and pick the posture on the Enforcement posture card. A sensible fleet pattern:
- Strict for anything that writes, deletes, spends, or reaches sensitive data
- Resilient for read-only convenience servers where availability wins
- Observe-only temporarily, for a newly-policied server in its first week
Step 3: Know what the audit trail shows
The posture leaves fingerprints in the Audit log: calls allowed under Resilient during a policy-read failure are marked as such, and Observe-only records every would-be decision. When you review an incident later, you can distinguish “policy allowed it” from “policy was unreadable and posture allowed it” — a distinction that matters enormously in a postmortem.
The onboarding pattern: Observe → enforce
The least disruptive way to roll out policies on a busy server:
- Configure your tool policies, sequence rules, and risk scoring with the server in Observe-only
- Watch a few days of audit logs: every deny and approval that would have happened is recorded
- Fix the false positives while nothing is blocking anyone
- Flip to Strict — enforcement lands with no surprises
FAQ
Does Resilient mode ever skip authentication?
No. Auth is enforced unconditionally in every posture. Posture only decides what happens to policy evaluation when the policy store can’t be read.
Does Observe-only disable all protection?
No — DLP scanning, rate limits, and payload limits keep enforcing. Only the allow/deny/approve policy decisions become log-only.
How often does the fail-open/fail-closed question actually matter?
Rarely — the gateway caches policies precisely to ride out backend blips. Posture is about the residual moments; rare is not never, and the setting decides who pays for those moments: availability or safety.
Can bundles have their own posture?
Postures are per server, so each member of a bundle keeps its own — your strict database server stays strict even bundled next to a resilient docs server.
Related Articles
- How to Control Which MCP Tools Your AI Can Run
- How MCP Trail Guardian Maps MCP Threats to Real Controls
- MCP Session Risk Scoring
- How to Check and Monitor MCP Server Logs
- MCP Security Best Practices
The failure-mode decision gets made either way — the only question is whether you made it. Create your free MCP Trail account and set it per server.