Lumos announced MCP Governance on 22 September 2026 for teams running Claude Code and Codex. The company says the product checks an AI agent's permissions at the moment it acts and blocks a tool call when policy does not allow it. Its own product page describes coverage for MCP servers, tool calls, bash commands, file edits and browser use, with every call recorded alongside the tool, inputs, human identity and policy decision.
This is a material product story because it maps directly to a current enterprise problem. MCP makes useful agents easier to connect to business systems. It also gives agents a route from a natural-language task into tools that can read, write or change state. Access reviewed later may be too late.
What Lumos launched
The release says MCP Governance is available today for Claude Code and Codex, with support for more agents to follow. The control sits as a hook before each tool call rather than as a gateway that reroutes every MCP server. Lumos says the check returns allow or deny and targets low latency.
The core argument is simple: an agent inherits the permissions of the person who launched it, then acts at machine speed. That means an employee's broad access can become an agent's broad action surface. Lumos frames MCP Governance as a way to move the control decision to the point before the action runs.
Lumos also published a same-week product page and blog post describing the control in more detail. Those are vendor sources, so claims about performance, coverage and operational impact should be tested in a buyer's own environment.
Why runtime policy matters
Traditional identity governance can say who has access. Agent governance also needs to ask what the agent is doing with that access right now. A developer may have permission to edit files, call a deployment script or query a CRM system. That does not mean every agent task should be able to use those capabilities.
Runtime policy can make that distinction. It can block a file edit outside the task scope, stop a code-execution tool connected to sensitive systems, or require a narrower rule for a production feature-flag change. The Maetra guide to preventing excessive agency uses the same control principle: do not let broad tool availability become broad agent authority.
The evidence teams should require
A product that governs tool calls should produce evidence, not only blocks. Security and compliance teams need to know which MCP server was called, by which agent, on whose behalf, under which task, with what policy verdict and what downstream effect.
The Maetra audit log guide is relevant here because post-incident review depends on the record, not the marketing category. If a policy denies a risky call, the record should show why. If it allows a call, the record should preserve enough context to prove that the action matched the authorised task.
Inventory is the companion control. Lumos argues that registering agents alone is insufficient, and that is right. Still, teams need the inventory first. The Maetra agent inventory guide explains how to connect agent, owner, tool surface and change history before runtime policy starts enforcing decisions.
What remains uncertain
The launch is supported mainly by Lumos materials and a distributed press release. The public sources reviewed here do not independently verify latency, false-positive rates, bypass resistance, customer outcomes or coverage across every local MCP configuration. They also do not show how much tool-call argument data a buyer should retain for compliance while limiting sensitive data exposure.
Those are not reasons to dismiss the release. They are the checklist for evaluation. Buyers should test whether the hook sees locally added MCP servers, whether policy decisions are explainable, whether evidence exports are complete and whether the control can fail closed without breaking safe workflows.
Maetra analysis
Lumos MCP Governance shows where agent products are moving: from agent inventory to action-time control. That is the right direction. The moment that matters is not only when a server is registered or when a quarterly access review happens. It is when an agent is about to use inherited access to call a tool.
For enterprises adopting coding agents and MCP, the practical control stack is clear. Discover the agent and its tools. Bind authority to the current task. Check each tool call before execution. Preserve the policy verdict and effect evidence. Then review patterns over time so broad access can be reduced instead of merely monitored.