PolicyGraph: A Policy-Gated MCP Runtime for Safe and Auditable Tool Execution

Enterprise deployments of large language model (LLM) agents increasingly rely on tool access to internal systems (document stores, ticketing platforms, policy knowledge bases). While tool augmentation improves capability, it introduces operational risks: unauthorized or side-effecting tool use, malformed tool arguments, unvalidated tool outputs, and summaries that introduce claims without traceable support.We present PolicyGraph, a deliberately narrow governance runtime for Model Context Protocol (MCP) tool orchestration that treats agent execution as governed computation rather than free-form autonomy. PolicyGraph enforces model-independent safety invariants: (i) default-deny tool execution through an operator-controlled allowlist (intersected with live tool discovery), (ii) strict JSON-only planning where the planner output must be exactly one JSON object, (iii) schema validation where tool arguments must match the live MCP inputSchema (required keys present, no extra keys, basic type checks), (iv) a typed tool output gate where a typed payload is produced only if the tool returns valid MCP structuredContent and a registered Pydantic model validates it, and (v) evidence-locked summarization where each summary item must include verbatim evidence copied from the canonicalized validated tool output. These mechanisms ensure that unsafe or malformed actions cannot execute and that any summary claim is at least lexically attributable to observed tool output. The runtime is single-step (at most one tool call per request), avoiding open-ended reasoning loops.We evaluate enforcement gates with LLM-independent property tests (N=1136 cases) and show that all hand-crafted and fuzzed negative cases generated by our suites are rejected while positive cases are accepted. PolicyGraph is designed to be reproducible and audit-friendly via per-run structured traces. Artifact (software) DOI: https://doi.org/10.5281/zenodo.18243973