Following CONTRIBUTING.md guidance to file an issue before opening a PR for a new lab.
Proposal
Add a new lab labs/atr-rule-enforcement/ that demonstrates pre-dispatch policy gating for MCP tool calls using the open Agent Threat Rules catalog. APIM evaluates the inbound MCP request against the catalog and blocks or sanitizes calls that match prompt injection or tool abuse patterns before the request reaches the backend MCP server.
Why this fits AI Gateway Labs
The existing model-context-protocol and mcp-client-authorization labs cover OAuth credential management and client authorization, which are the trust establishment layer. This lab would cover the request introspection layer, complementing rather than overlapping. The pattern uses APIM inbound policy XML to call an external policy decision point (the ATR catalog endpoint) using existing send-request and choose policies, so it stays within mainstream APIM patterns and does not require any new APIM features.
Lab structure (matching existing labs)
labs/atr-rule-enforcement/
README.MD
atr-rule-enforcement.ipynb
policy.xml
main.bicep
clean-up-resources.ipynb
What the notebook teaches
How to register the ATR catalog as an APIM backend
How to write an inbound policy that evaluates the MCP tool call payload against the catalog
How to make blocking versus advisory enforcement decisions based on rule severity
How to log policy decisions to App Insights for audit
Architecture
Client to APIM (MCP request) to ATR policy decision point (verdict cache via internal APIM cache) to backend MCP server. APIM policy short circuits with 403 on block, attaches an x-atr-verdict header on allow.
Why this is community contribution and not commercial
The catalog is Apache 2.0 open source. The lab notebook, policy XML, and Bicep are MIT licensed contributions. Audit evidence generation, framework cross walks, and dashboards are not included; those remain in the commercial product. This keeps the lab fully open and reusable.
Production references for the underlying catalog
ATR is at 330 rules with 100% NIST AI RMF (AI 600 to 1) coverage and 97.1% recall on garak prompt injection benchmarks. Cisco AI Defense and Microsoft Agent Governance Toolkit (PRs #908 and #1277) have merged ATR rule packs in 2026.
Repo links
ATR catalog at https://github.com/Agent-Threat-Rule/agent-threat-rules (Apache 2.0)
NIST AI RMF cross walk in OSCAL format at https://github.com/Agent-Threat-Rule/ai-rmf-oscal-catalog (CC0)
Open questions for the team before opening a PR
Are you already tracking a similar lab idea, especially given the labs/content-safety lab covers a related but provider specific surface?
Preferred Bicep parameter style and which AI Foundry tier should the lab target?
Should the catalog endpoint be a notebook simulated mock for self contained labs, or should the lab call out to a public ATR endpoint?
Any team contact in the AI Gateway dev portal effort we should align this lab with?
Microsoft CLA can be signed as soon as we have a green light on lab scope and naming.
Following CONTRIBUTING.md guidance to file an issue before opening a PR for a new lab.
Proposal
Add a new lab labs/atr-rule-enforcement/ that demonstrates pre-dispatch policy gating for MCP tool calls using the open Agent Threat Rules catalog. APIM evaluates the inbound MCP request against the catalog and blocks or sanitizes calls that match prompt injection or tool abuse patterns before the request reaches the backend MCP server.
Why this fits AI Gateway Labs
The existing model-context-protocol and mcp-client-authorization labs cover OAuth credential management and client authorization, which are the trust establishment layer. This lab would cover the request introspection layer, complementing rather than overlapping. The pattern uses APIM inbound policy XML to call an external policy decision point (the ATR catalog endpoint) using existing send-request and choose policies, so it stays within mainstream APIM patterns and does not require any new APIM features.
Lab structure (matching existing labs)
labs/atr-rule-enforcement/
README.MD
atr-rule-enforcement.ipynb
policy.xml
main.bicep
clean-up-resources.ipynb
What the notebook teaches
How to register the ATR catalog as an APIM backend
How to write an inbound policy that evaluates the MCP tool call payload against the catalog
How to make blocking versus advisory enforcement decisions based on rule severity
How to log policy decisions to App Insights for audit
Architecture
Client to APIM (MCP request) to ATR policy decision point (verdict cache via internal APIM cache) to backend MCP server. APIM policy short circuits with 403 on block, attaches an x-atr-verdict header on allow.
Why this is community contribution and not commercial
The catalog is Apache 2.0 open source. The lab notebook, policy XML, and Bicep are MIT licensed contributions. Audit evidence generation, framework cross walks, and dashboards are not included; those remain in the commercial product. This keeps the lab fully open and reusable.
Production references for the underlying catalog
ATR is at 330 rules with 100% NIST AI RMF (AI 600 to 1) coverage and 97.1% recall on garak prompt injection benchmarks. Cisco AI Defense and Microsoft Agent Governance Toolkit (PRs #908 and #1277) have merged ATR rule packs in 2026.
Repo links
ATR catalog at https://github.com/Agent-Threat-Rule/agent-threat-rules (Apache 2.0)
NIST AI RMF cross walk in OSCAL format at https://github.com/Agent-Threat-Rule/ai-rmf-oscal-catalog (CC0)
Open questions for the team before opening a PR
Are you already tracking a similar lab idea, especially given the labs/content-safety lab covers a related but provider specific surface?
Preferred Bicep parameter style and which AI Foundry tier should the lab target?
Should the catalog endpoint be a notebook simulated mock for self contained labs, or should the lab call out to a public ATR endpoint?
Any team contact in the AI Gateway dev portal effort we should align this lab with?
Microsoft CLA can be signed as soon as we have a green light on lab scope and naming.