LoFP LoFP / teams enable approved mcp connectors for data platforms, ticketing systems, and internal tools during claude rollouts. validate the server name, actor, and whether the integration matches an approved request.

Techniques

Sample rules

Anthropic MCP Server Created

Description

Detects the first successful creation of a Model Context Protocol (MCP) server integration name in an Anthropic organization within the rule history window. MCP servers add external data pathways into Claude and can expose organizational data to third-party infrastructure. This is a New Terms rule keyed on organization.id and anthropic.audit.mcp_server_name so the same connector name can still alert in another tenant, while routine re-creation of an already-seen name in the same organization does not.

Detection logic

data_stream.dataset: "anthropic.audit" and
    event.category: "configuration" and
    event.action: "mcp_server_created" and
    event.outcome: "success"