@@ -86,6 +86,7 @@ def _resolve_mcp_server_name(raw_payload: dict) -> Optional[str]:
     if not url and not command:
         return None
 
+    lowered_command = command.lower() if command else None
     for config_path in _cursor_mcp_config_paths(raw_payload.get('workspace_roots')):
         servers = (_load_cursor_mcp_config(config_path) or {}).get('mcpServers')
         if not isinstance(servers, dict):
@@ -95,7 +96,7 @@ def _resolve_mcp_server_name(raw_payload: dict) -> Optional[str]:
                 continue
             if url and server.get('url') == url:
                 return name
-            if command and (command == _server_command_line(server) or command.lower() == str(name).lower()):
+            if command and (command == _server_command_line(server) or lowered_command == str(name).lower()):
                 return name
 
     return command
 
@@ -70,14 +70,20 @@ def __post_init__(self) -> None:
             if guardrail.get('key') in _KNOWN_GUARDRAIL_KEYS
         }
 
+    @property
+    def ttl_seconds(self) -> float:
+        return self.payload.get('ttl_seconds') or DEFAULT_TTL_SECONDS
+
+    def _agents(self, guardrail_key: str) -> dict:
+        return (self._guardrails.get(guardrail_key) or {}).get('agents') or {}
+
     def mode_for(self, guardrail_key: str, ide_name: Optional[str]) -> str:
         """The platform keys the cells by our --ide names, so the lookup is direct."""
-        agents = (self._guardrails.get(guardrail_key) or {}).get('agents') or {}
+        agents = self._agents(guardrail_key)
         return str(agents.get((ide_name or '').lower(), default_mode_for(guardrail_key))).lower()
 
     def is_off_for_every_agent(self, guardrail_key: str) -> bool:
-        agents = (self._guardrails.get(guardrail_key) or {}).get('agents') or {}
-        return all(str(mode).lower() == GuardrailCellMode.OFF for mode in agents.values())
+        return all(str(mode).lower() == GuardrailCellMode.OFF for mode in self._agents(guardrail_key).values())
 
     def _modes_for_event(self, event_name: str, ide_name: Optional[str]) -> list:
         return [
@@ -101,8 +107,7 @@ def sensitive_globs(self) -> list:
         return globs if isinstance(globs, list) and globs else _default_sensitive_globs()
 
     def is_expired(self) -> bool:
-        ttl = self.payload.get('ttl_seconds') or DEFAULT_TTL_SECONDS
-        return time.time() - self.fetched_at > ttl
+        return time.time() - self.fetched_at > self.ttl_seconds
 
     def needs_refresh(self, tenant_id: Optional[str]) -> bool:
         """Expired, or fetched for another tenant (the user switched tenants since)."""
 
@@ -97,14 +97,11 @@ def match(self, alias: str) -> Optional[McpServerMatch]:
             return exact
 
         wanted = _normalize_alias(alias)
-        normalized = [known for key, known in self._by_alias.items() if _normalize_alias(key) == wanted]
+        candidates = [(_normalize_alias(key), known) for key, known in self._by_alias.items()]
+        normalized = [known for key, known in candidates if key == wanted]
         if not normalized and wanted.startswith(_PLUGIN_ALIAS_PREFIX):
             # The plugin name may itself contain '_', so the server is the longest known suffix.
-            suffixes = [
-                (len(_normalize_alias(key)), known)
-                for key, known in self._by_alias.items()
-                if wanted.endswith(f'_{_normalize_alias(key)}')
-            ]
+            suffixes = [(len(key), known) for key, known in candidates if wanted.endswith(f'_{key}')]
             longest = max((length for length, _ in suffixes), default=None)
             normalized = [known for length, known in suffixes if length == longest]
 
 
@@ -16,7 +16,7 @@
     get_ide,
 )
 from cycode.cli.apps.ai_guardrails.scan.guardrail_config import (
-    DEFAULT_TTL_SECONDS,
+    GuardrailConfig,
     load_guardrail_config,
     save_guardrail_config,
 )
@@ -181,13 +181,13 @@ def session_start_command(
     context_reported = _report_session_context(ai_client, session_payload.ide_user_email, auth_info.tenant_id)
 
     # SessionStart precedes the first prompt hook in every IDE, so scans normally find a cache.
-    _sync_guardrail_config(ai_client, auth_info.tenant_id)
+    config = _sync_guardrail_config(ai_client, auth_info.tenant_id)
 
     # After the report, so the statuses cover the MCP configs the platform just ingested.
-    _sync_mcp_server_statuses(ai_client, auth_info.tenant_id, force=context_reported)
+    _sync_mcp_server_statuses(ai_client, config, auth_info.tenant_id, force=context_reported)
 
 
-def _sync_guardrail_config(ai_client: 'AISecurityManagerClient', tenant_id: Optional[str]) -> None:
+def _sync_guardrail_config(ai_client: 'AISecurityManagerClient', tenant_id: Optional[str]) -> Optional[GuardrailConfig]:
     """Refresh the guardrail config cache when it is expired or belongs to another tenant.
 
     Every step here swallows its own failures - a broken cache or an unreachable platform
@@ -196,17 +196,21 @@ def _sync_guardrail_config(ai_client: 'AISecurityManagerClient', tenant_id: Opti
     cached = load_guardrail_config()
     if cached is not None and not cached.needs_refresh(tenant_id):
         logger.debug('Guardrail config cache is fresh, skipping fetch')
-        return
+        return cached
 
     resolved = ai_client.get_resolved_guardrails()
-    if resolved:
-        save_guardrail_config(resolved, tenant_id)
-        logger.debug('Guardrail config cache updated')
+    if not resolved:
+        return cached
+
+    save_guardrail_config(resolved, tenant_id)
+    logger.debug('Guardrail config cache updated')
+    return GuardrailConfig(payload=resolved, fetched_at=time.time(), tenant_id=tenant_id)
 
 
-def _sync_mcp_server_statuses(ai_client: 'AISecurityManagerClient', tenant_id: Optional[str], force: bool) -> None:
+def _sync_mcp_server_statuses(
+    ai_client: 'AISecurityManagerClient', config: Optional[GuardrailConfig], tenant_id: Optional[str], force: bool
+) -> None:
     """``force``: a just-reported session context may have brought servers the cache doesn't cover."""
-    config = load_guardrail_config()
     if config is None or config.is_off_for_every_agent(BlockReason.UNAUTHORIZED_MCP_SERVER):
         logger.debug('Unauthorized MCP server guardrail is off, skipping MCP server statuses fetch')
         return
@@ -221,7 +225,7 @@ def _sync_mcp_server_statuses(ai_client: 'AISecurityManagerClient', tenant_id: O
         save_mcp_server_statuses(
             response.servers,
             tenant_id,
-            config.payload.get('ttl_seconds') or DEFAULT_TTL_SECONDS,
+            config.ttl_seconds,
             response.should_treat_unreviewed_as_unauthorized,
         )
         logger.debug('MCP server statuses cache updated')
@@ -4,6 +4,7 @@
 import time
 from io import StringIO
 from pathlib import Path
+from typing import Optional
 from unittest.mock import ANY, MagicMock, patch
 
 import pytest
@@ -743,26 +744,22 @@ def _guardrail_config_with_mcp_server(agents: dict) -> GuardrailConfig:
     ],
 )
 def test_mcp_server_statuses_not_fetched_while_the_guardrail_is_off(
-    config: object, monkeypatch: pytest.MonkeyPatch, mock_save_mcp_server_statuses: MagicMock
+    config: Optional[GuardrailConfig], mock_save_mcp_server_statuses: MagicMock
 ) -> None:
-    monkeypatch.setattr(_session_start_mod, 'load_guardrail_config', MagicMock(return_value=config))
     ai_client = MagicMock()
 
-    _session_start_mod._sync_mcp_server_statuses(ai_client, 'tenant-a', force=True)
+    _session_start_mod._sync_mcp_server_statuses(ai_client, config, 'tenant-a', force=True)
 
     ai_client.get_mcp_server_statuses.assert_not_called()
     mock_save_mcp_server_statuses.assert_not_called()
 
 
-def test_mcp_server_statuses_fetched_when_on_for_some_agent(
-    monkeypatch: pytest.MonkeyPatch, mock_save_mcp_server_statuses: MagicMock
-) -> None:
+def test_mcp_server_statuses_fetched_when_on_for_some_agent(mock_save_mcp_server_statuses: MagicMock) -> None:
     config = _guardrail_config_with_mcp_server({'cursor': 'Off', 'claude-code': 'Report'})
-    monkeypatch.setattr(_session_start_mod, 'load_guardrail_config', MagicMock(return_value=config))
     ai_client = MagicMock()
     ai_client.get_mcp_server_statuses.return_value = _STATUSES_RESPONSE
 
-    _session_start_mod._sync_mcp_server_statuses(ai_client, 'tenant-a', force=False)
+    _session_start_mod._sync_mcp_server_statuses(ai_client, config, 'tenant-a', force=False)
 
     # Cached with the guardrail config's TTL and the policy's strict-mode flag.
     mock_save_mcp_server_statuses.assert_called_once_with(_SERVERS, 'tenant-a', 600, True)
@@ -773,32 +770,28 @@ def test_fresh_mcp_server_statuses_skip_the_fetch_unless_forced(
 ) -> None:
     config = _guardrail_config_with_mcp_server({'cursor': 'Block'})
     cached = McpServerStatuses(servers=[], fetched_at=time.time(), tenant_id='tenant-a')
-    monkeypatch.setattr(_session_start_mod, 'load_guardrail_config', MagicMock(return_value=config))
     monkeypatch.setattr(_session_start_mod, 'load_mcp_server_statuses', MagicMock(return_value=cached))
     ai_client = MagicMock()
     ai_client.get_mcp_server_statuses.return_value = _STATUSES_RESPONSE
 
-    _session_start_mod._sync_mcp_server_statuses(ai_client, 'tenant-a', force=False)
+    _session_start_mod._sync_mcp_server_statuses(ai_client, config, 'tenant-a', force=False)
     ai_client.get_mcp_server_statuses.assert_not_called()
 
     # Another tenant's cache is refetched.
-    _session_start_mod._sync_mcp_server_statuses(ai_client, 'tenant-b', force=False)
+    _session_start_mod._sync_mcp_server_statuses(ai_client, config, 'tenant-b', force=False)
     assert ai_client.get_mcp_server_statuses.call_count == 1
 
     # A just-reported session context forces a refetch.
-    _session_start_mod._sync_mcp_server_statuses(ai_client, 'tenant-a', force=True)
+    _session_start_mod._sync_mcp_server_statuses(ai_client, config, 'tenant-a', force=True)
     assert ai_client.get_mcp_server_statuses.call_count == 2
 
 
-def test_failed_mcp_server_statuses_fetch_keeps_the_cache(
-    monkeypatch: pytest.MonkeyPatch, mock_save_mcp_server_statuses: MagicMock
-) -> None:
+def test_failed_mcp_server_statuses_fetch_keeps_the_cache(mock_save_mcp_server_statuses: MagicMock) -> None:
     config = _guardrail_config_with_mcp_server({'cursor': 'Block'})
-    monkeypatch.setattr(_session_start_mod, 'load_guardrail_config', MagicMock(return_value=config))
     ai_client = MagicMock()
     ai_client.get_mcp_server_statuses.return_value = None
 
-    _session_start_mod._sync_mcp_server_statuses(ai_client, 'tenant-a', force=True)
+    _session_start_mod._sync_mcp_server_statuses(ai_client, config, 'tenant-a', force=True)
 
     mock_save_mcp_server_statuses.assert_not_called()