Skip to main content
Custom blocklists let enterprise users define domain and command restrictions beyond ThornGuard’s built-in security rules. They are the coarse-grained settings layer of the platform.
Custom blocklists are an Enterprise-only feature. Individual plan users are protected by ThornGuard’s built-in rules.

​
Domain Blocklists

Block specific upstream MCP server domains that your organization doesn’t want AI agents to access.

​
How It Works

  1. Configure blocked domains from the Settings page.
  2. The blocklist is stored per-license in the license_settings table as a JSON array.
  3. When a request arrives, the x-mcp-target-url domain is checked against the blocklist.
  4. Wildcard patterns are supported — *.example.com blocks all subdomains.

​
Example Domain Blocklist

["dangerous-service.com", "*.untrusted-provider.net", "internal-only.corp.example.com"]

​
Blocked Requests

  • HTTP response: 403 Forbidden
  • Audit action: BLOCKED_CUSTOM_DOMAIN
  • Details include the blocked domain context.

​
Command Blocklists

Block specific command patterns that you don’t want AI agents to execute, beyond the built-in blocked signatures.

​
How It Works

  1. Configure blocked command patterns from the Settings page.
  2. Patterns are stored per-license in license_settings.blocked_commands as a JSON array.
  3. Each pattern is checked as a substring match against the stringified JSON-RPC payload.
  4. If any pattern matches, the request is immediately blocked.

​
Example Command Blocklist

["DROP TABLE", "DELETE FROM", "TRUNCATE", "format c:", "shutdown"]

​
Blocked Requests

  • HTTP response: 400 Bad Request
  • Audit action: BLOCKED_CUSTOM_COMMAND
  • Details include the matched command context.
If you need finer-grained matching than substring blocklists, use ThornGuard’s structured Policies & Webhooks capabilities.

​
Managing Blocklists

Both domain and command blocklists are managed from the ThornGuard Dashboard → Settings page:
  • Add entries using the tag input — type a pattern and press Enter.
  • Remove entries by clicking the × on any tag.
  • Changes take effect immediately on the next request.