A custom sh script or something for whitelists would take ~5min to setup.
For more robust governance (many policies), you can write Rego using https://github.com/eqtylab/cupcake
https://code.claude.com/docs/en/hooks#mcp-tool-naming