This topic provides a comprehensive overview of how administrators can leverage the Skope IT application to monitor Model Context Protocol (MCP) communications in real-time. You will learn how to gain granular visibility into the entire interaction lifecycle—ranging from initial handshakes and protocol versioning to specific tool invocations and resource requests—while ensuring organizational compliance and threat detection. By the end of this guide, you will understand how to analyze detailed event logs to verify successful executions and how to protect sensitive data within your network’s MCP ecosystem.
Netskope allows for policy enforcement based on attributes found in the HTTP headers of MCP communications.
Supported Attributes
- MCP Session ID: An identifier for the entire set of events between a client and server.
- MCP Protocol Version: Date-based versioning (e.g., 2025-11-25) used to track protocol changes.
Step-by-Step Configuration
- Create a Header Profile:
- For Session IDs, use wildcards (e.g., *) to catch all sessions.
- For Protocol Versions, specify exact versions (e.g., 2025-06-18) to target older or unstable iterations.
- Create a Policy:
- Category: Select “MCP Server.”
- Criteria: Choose “HTTP Header.”
- Action: Select “Block” to prevent traffic matching the profile.
The Model Context Protocol allows for the inclusion of certain fields or attributes in the HTTP header during the communication between the MCP client and the MCP server. Netskope has introduced the capability to configure HTTP header-based policies to block or alert when a certain value occurs in these attributes. The model context protocol supports two fields in the HTTP headers, MCP session ID and the MCP protocol version. The MCP session ID is an identifier for an entire set of events between the client and the server from the initialization of the session till the close. of connection. Most MCP sessions have a session ID. The model context protocol uses date based versioning to track changes with multiple versions currently available for use. The latest stable version is the 2025-11-25 version with many enhancements for security. Organizations may want to alert when an older MCP Protocol Version is used or even block the use of older versions.
To create an HTTP header-based policy, we create a header profile. For example you can create a header-profile based on the MCP session ID field. To block all sessions provide a wild card in the value to match.
Http Header Profile: Create an HTTP Header Profile using the field mcp-session-id and providing a wildcard so that the policy can be applied to any MCP traffic.
Now create a new policy. Select the category and choose “MCP Server” for the category. Select all the applicable types of MCP activities. Choose a HTTP header which is for the session ID. Give a policy name that is appropriate and then choose the profile and action – “Block”.
Policy Configuration Interface: The “Create Policy” screen. The “Category” dropdown is set to “MCP Server,” all activities selected and the “Profile & Action” field is set to Block for a custom HTTP Header profile “mcp-session-id” to block all MCP traffic.
To test this, run the MCP server and take a look at the SkopeIT events. We’ll see that any MCP event for that MCP server now is blocked because we have given a wildcard character to catch all session ids.
Application Events page and Details pane: Every MCP event is blocked due to this policy
You can create another header profile. This time, one for the protocol version giving specifically the “2025-06-18” version which is older than the latest stable version.
Http Header Profile: Create an HTTP Header Profile using the field mcp-protocol-version and providing a version such as “2025-06-18” so that the policy can be applied to MCP traffic using that version.
Create a policy for the protocol version.
Policy Configuration Interface: The “Create Policy” screen. The “Category” dropdown is set to “MCP Server,” all activities selected and the “Profile & Action” field is set to Block for a custom HTTP Header profile “mcp-protocol-version” to block a specific protocol version.
Run the MCP server which uses that particular protocol version. Review the events in the Application Events page of SkopeIT. You’ll see that the events of the MCP server that uses the older protocol version are blocked as this policy blocks it.
Application Events page and Details pane: Every MCP event using this protocol version is blocked due to this policy.