ML
Marcus Lee
13 hours ago
Nightfall Gateway blocked gh pr create and I thought my token died
Nightfall MCP Gateway
Govern Cursor and Claude Code MCP tool calls
Tried Nightfall MCP Gateway this week on Cursor. First useful deny was real — it caught an agent about to cat a .env. Cool.
Then it blocked gh pr create for a hotfix and the error just said tool denied. Spent 40 minutes rotating PATs before I found the allowlist missed pull_request.create.
Anyone else running this with a break-glass path, or do you just flip deny off at 2am?
2 comments
Join the discussion
Log in to comment.
we hit the same thing the night before launch. two engineers, no time for a policy ticket.
ended up with a 30-min override token in 1password and a slack ping when it gets used. permanent deny:false felt worse than the miss we were trying to stop.
if the deny log does not show the exact tool name + args, debugging becomes guesswork.
ours printed
github.create_pull_requestbut Cursor UI just said "blocked". mismatch like that wastes more time than the policy saves.