2026年AI智能体数据安全态势报告 STATE OF AGENTIC DATA SECURITY 2026

NIGHTFALLAI

202

88.9MMCPEVENTSOBSERVED

608DISTINCTMCPPACKAGESIDENTIFIEDNIGHTFALL.AI

CONTENTS

what'sinside

01Executivesummary

02

Theblindspot

03

whyLegacyDLpisblindtoMCPactivity

O4

TheMcpsurface

04.1

Approximately70%oforganizationsrunatleast1unsupportedMCPserver

04.2

2in3observedpackageshavenoverifiedpublisher

04.3

1in5organizationsrouteofficialMCPtrafficthroughanunverifiedintermediary

04.4

12+agentclientslaunchMCPservers

5

credentialsintheblindspot

05.1

Whythesafepatternisdifficulttomaintain

wherecontrollives

whatfullcoveragereauires

McpsecurityReadinesschecklist

HowNightfallclosesthesegaps

Method

o1Executivesummary

TherapidadoptionofAIagentsiscreatinganewvisibilityandgovernancechallenge.ThroughtheMCPserversthey

connectto,agentscanaccesssourcecode,credentials,productiondatabases,cloudinfrastructure,email,calendars,

designsystems,HRplatforms,financetools,andCRMdata.Muchofthisactivityoccursoutsidethecontrolsdesignedtomonitorhuman-drivendatamovement.

Thisreportisbasedonobservedactivity,notsurveyresponses.Across88.9millionMCPeventsinNightfall’s

enterprisecustomerbaseovera3-monthperiod,weidentified608distinctMCP-associatedpackages.Thelargestisoperatingalmost200MCPs.AverageMCPtool-callvolumeperorganizationgrewnearly4×fromJuneto

July2026.

Anewclassofdatamover

Fortwodecades,datalosspreventionhasrestedononeassumption:apersonmovesdata.Someoneattachesafile,pastesintoabrowser,orsendsamessage,andacontrolinspectsthatactionasahumantakesit.Everymature

categoryinheritstheassumption—endpointDLPwatchestheuser’sdevice,CASBandSSEinspecttheuser’straffic,emailDLPscanswhattheusersends.

AIagentsbreakit.Anagentisaprocessthatholdscredentials,chainstoolcalls,andmovesdatabetweensystemsatmachinespeedwithoutahumaninitiatingeachstep.Whenanagentreadsarepository,queriesaproductiondatabase,andwritestheresultintoaticket,nouploadoccurred,nopasteoccurred,andnomessagewassent.Thedatamovedanyway.TheModelContextProtocolmakesthispossibleatenterprisescale—oneprotocol,hundredsofservers,

accesstosourcecontrol,cloudinfrastructure,databases,communications,andknowledgebases—sotheriskarrivesuniformlyacrosstheestateratherthanappbyapp.

whytheincumbentcategoriescannotclosethegap

Thegapisarchitectural,notamatteroffeaturematurity.LegacyDLPispattern-matchedtohumangestures:itcan

classifyafileandblockanupload,butithasnoconceptofatoolcall,norecordofwhichserverinitiatedanaction,andnoviewofwhatatoolreturned.Anagentthatneveruploadsanythingnevertripsit.

Network-deliveredcontrols—securewebgateways,CASB,SSE,andtheemergingMCPgatewaycategory—canonlyactontrafficthatcrossesanetworkboundary,andmuchMCPactivityneverdoes.Wheretrafficdoescross,agatewayseesanordinaryAPIcalltoanexpecteddomain,nottheagentbehinditorthepayload’smeaning.EndpointandEDRtoolingcanseeaprocessstart,butprocesstelemetryisnotdatatelemetry.Postureandregistrytoolsinventorywhatwasapprovedratherthanwhatisrunning—andthisreport’scentralfindingisthatthetwolistsdiffer.Identitysystemscanscopeagrantbutcannotinspecttoolargumentsorreturnedcontent.

Theresultisacategory-wideblindspot.Nocontrolplaneinproductiontodaycoversdiscoveryoflocalservers,inspectionofconfigurationfiles,semanticvisibilityintotoolcalls,andpre-executionenforcementatonce.

ASecondthreatsurface:theagent'sowntrustboundary

Agentsroutinelyprocessuntrustedcontent—webpages,repositorycontents,documents,emails,andtoolresponses—andanyofitcancarryaninstruction.Apayloadarrivingthroughonetoolresponsecaninfluencetheagenttoreadfromanotherconnectedsystem,exposeacredential,ortakeanunauthorizedaction.Thevulnerablecomponentandthe

sensitiveresourceneednotshareatrustdomain,andatrustedparentprocessisnotatrustboundary.Theobserved

datashowsthisisnotafutureexposure:credential-formatstringssatinconfigurationfilesinnearlyhalfoforganizations,1in5routedofficialtrafficthroughanunverifiedproxy,and12ormoreagentclientswerelaunchingservers.

hatthedatashows

LocalMCPserversarewidespreadandlargelyinvisibletonetworkcontrols.Abrowser-automationserverwasobservedinnearlyhalfoforganizations,ChromeDevToolsinapproximately40%,Docker’sMCPpluginin35%,adebuggerserverin30%,andacontainerizedGitHubserverin25%.Becausetheseexchangesoccurlocally,thetrafficmaynevercrossagatewayorproxy.

~70%oforganizationswererunningatleast1unsupportedMCPserver.@modelcontextprotocol/server-

postgres,lastpublishedinDecember2024andmarked“nolongersupported,”waspresentinroughly25%of

organizations.Someofthesedeprecatedpackagesremainconnectedtoproductiondatabases,repositories,andcollaborationsystems.

2in3observedMCPpackageshadnoverifiedpublisher.Securityteamsoftencannotestablishwhoproducedapackage,whetheritisstillmaintained,orwhethertheinstalledsoftwarecorrespondstotheexpectedvendor.

Nearly50%oforganizationsexposedcredentialsinMCPconfigurationfiles.Environment-variableindirection—thedocumentedalternative—appearedinfewerthan1in10credential-bearingconfigurations.MCPconfigurationfilesarebecominganew,largelyunmonitoredcredentialstore.

Atleast1in5organizationsroutedanofficialMCPconnectionthroughanunverifiedintermediary.AgentsreachedAtlassian’sofficialMCPendpointthroughmcp-remote,acommunityproxymaintainedby2individualsandlackingaverifiedpublisher.Thefinaldestinationappearedlegitimate,whiletheadditionaltrustlayer

remainedlargelyinvisible.

12+agentclientswereobservedlaunchingMCPservers.TheecosystemextendswellbeyondClaudeCode,Cursor,andVSCodetoCodex,Zed,ChatGPT,cmux,PyCharm,IntelliJIDEA,WebStorm,andotherdevelopmentandorchestrationtools.Governing1clientdoesnotgovernthebroaderMCPsurface.

NosinglecontrolplanecoversthefullMCPlifecycle.Gatewayscaninspectremotetrafficbutcannotseelocalserversorconfigurationfiles.Endpointcontrolscandiscoverlocalactivitybutmaynotcoverunmanageddevices.Runtimehookscaninspecttoolcallsbutmustbedeployedseparatelybyclient.Identity,authorization,registry,

andcompliancesystemseachaddressonlypartoftheproblem.

Theremainderofthisreporttranslatesthesefindingsintoathreatmatrix,acontrol-planecoveragematrix,11controlrequirements,andanMCPSecurityReadinessChecklist.Thefoundationalquestionremains:WhichMCPserversarecurrentlyrunningacrosstheorganization—andcanriskyactionsbestoppedbeforetheyexecute?

02Theblindspot

Nearly50%oforganizationsrunalocalMCPserverthenetworkmayneversee

Anetworkcontrolplaneseesonlytrafficthatcrossesanetworkboundary.MCPactivitydoesnotalwaysdothat.

RemoteMCPserverscommunicateacrossthenetwork,wheretheirtrafficcanberoutedthroughagatewayorproxy.LocalMCPserversaredifferent.Theyrunaschildprocessesonthesamedeviceastheagenthostandcommonly

communicateoverstandardinputandoutput.Theprompts,toolrequests,queryresults,filecontents,andcredentialsexchangedbetweentheagentandservermayneverleavetheendpoint.

Asaresult,agatewaythatseeseveryremoteMCPconnectionmaystillbeblindtoalargeshareofactualMCPactivity.Localserverswerecommonacrosstheorganizationsobserved.

TABLE1.LOCALMCPSERVERSOBSERVEDRUNNING,BYSHAREOFORGANIZATIONS.

MCP

LOCAL

SERVER

SHARE

OFORGANIZATIONS

Browserautomation(playwright-mcp)

~45%

ChromeDevTools(chrome-devtools-mcp)

~40%

DockerMCPplugin(docker-mcp)

~35%

Debugger(lldb-mcp)

~30%

ContainerizedGitHub(

ghcr.io/github/github-mcp-server

)

~25%

Thecontrolgapisarchitectural.Anetworkproductcannotinspecttrafficthatneverreachesthenetwork.AnycontrolplanethatdependsontrafficpassingthroughaproxyisstructurallyblindtolocalMCPactivity.

Somelocalserversmakeoutboundcallsthatagatewaycanobserve.ButwhatthegatewayseesisanordinaryAPI

requestfromthehost—notwhichMCPserverinitiatedit,whichagentinvokedtheserver,whattoolwascalled,orwhatdatawasreturned.

whyatrustedparentisnotatrustboundary

TheparentprocessidentifieswhichapplicationlaunchedanMCPserver.Itdoesnotestablishwhattheservercanaccess,whopublishedit,whetheritismaintained,orhowitwillbehave.

Thisdistinctionmattersbecauseagentsroutinelyprocessuntrustedcontent:webpages,repositorycontents,

documents,emails,tooldescriptions,andtoolresponses.AnMCPservercanintroduceinstructionsintotheagent’scontext,andthoseinstructionsmayinfluencelatertoolcallsordataaccess.

Theresultingtrustchainislongerthanitappears:

Untrustedcontent→agentcontext→MCPtoolcall→sensitivesystem

Aprompt-injectionpayloadarrivingthroughonetoolresponsecaninfluencetheagenttoreadfromanotherconnectedsystem,exposeacredential,orperformanunauthorizedaction.Thevulnerablecomponentandthesensitiveresourcedonotneedtosharethesametrustdomain.

03whyLegacyDLpisblindtoMcpactivity

Agenticdatamovementdoesnotfollowahuman-controlledpath

LegacyDLPwasdesignedaroundrecognizablehumanactions:uploadingafile,pastingintoawebpage,sendinganemail,copyingtoremovablemedia,ormovingcontentthroughamanagedSaaSapplication.

Agenticdatamovementfollowsadifferentpath.

Anagentcanreadalocalfile,queryadatabase,retrievesourcecode,callanAPI,transformtheresult,andsenditto

anothertoolwithoutahumanmanuallyinitiatingeachstep.Themovementoccursthroughtoolcallsandagentruntimesratherthantheupload,paste,andsendactionstraditionalDLPwasdesignedtomonitor.

LegacyDLPgenerallydoesnotunderstand:

—WhichMCPserverinitiatedanaction—Whichtoolwascalled

—Whatargumentswerepassed—Whatdatathetoolreturned

—Whetherthedestinationwasexpected—Whetherretrieveddatainfluencedalateraction

—Whetheraninstructionoriginatedfromanuntrustedtoolresponse

Moderndatasecuritymustcoverbothhumanandagentactivity,withruntimecontextabouttheagent,tool,destination,action,anddatainvolved.

Withoutthatcontext,acontrolmayseeanAPIrequestorprocessexecutionwhilemissingtheagenticworkflowthatproducedit.

4TheMcpsurface

MCPisalreadyanenterprise-widestack,notasingledevelopertool

MCPadoptionspansdevelopment,communications,knowledgemanagement,design,observability,cloudinfrastructure,databases,finance,andgo-to-marketsystems.

ThemostwidelyreachedremoteMCPendpointswerenotlimitedtoAI-nativeplatforms.Theyincludedenterprise

servicessuchasAtlassian,GitHub,Microsoft,Google,Slack,Notion,Figma,Docker,Linear,GitLab,Asana,andDatadog.

TABLE2.MOSTWIDELYREACHEDREMOTEMCPENDPOINTS,MAY–JULY2026.

ENDPOINT

SHAREOFORGANIZATIONS

CONNECTIONS

AnthropicMCPproxy

~75%

526,167

Atlassian

~75%

7,195,970

GitHubCopilotAPI

~75%

192,851

MicrosoftLearn

~75%

17,203

GoogleFirestore

~70%

1,288,134

Slack

~70%

310,219

Notion

~65%

308,008

HuggingFace

~65%

20,771

Figma

~65%

301,082

Docker

~60%

171,977

Linear

~60%

309,761

GitLab

~55%

2,754,525

Asana

~50%

28,817

Datadog

~50%

85,142

Thebreadthoftheseconnectionsmatters.MCPisnotconfinedtoexperimentaldeveloperenvironments.Itisbecominganaccesslayeracrossthesystemswhereorganizationsstoresourcecode,credentials,internalknowledge,operationaltelemetry,customerdata,andbusinessrecords.

TABLE3.MCPSERVERCATEGORIESBYSHAREOFORGANIZATIONS.FUNCTIONALCATEGORYISOBSERVABLEFROMTHESERVERITSELF;ASSIGNMENTISANANALYSTPASSOVERAFIXEDVENDORLIST.

CATEGORYSHAREOFORGANIZATIONS

Docs&knowledge

~90%

Workmanagement

~85%

Sourcecontrol&CI

~80%

AIplatform

~75%

CATEGORYSHAREOFORGANIZATIONS

Communications

~75%

Databases&datastores

~70%

Design

~65%

Cloud&infrastructure

~60%

Finance>M

~60%

Observability&ops

~55%

Assignmenttoafunctionalcategoryisbasedontheserveritself.Individualimplementationsmayspanmultiplefunctionsorexposeaccesstomorethanonesystem.

04.1Approximately70%oforganizationsrunatleast1unsupportedMcpserver

UnsupportedMCPsoftwareisalreadypresentinproductionenvironments.

@modelcontextprotocol/server-postgreswaslastpublishedinDecember2024andisexplicitlymarked“nolonger

supported.”Itwasobservedinapproximately25%oforganizations,includingenvironmentswhereitwasconnectedtoproductiondatabases.

Thepackagewasoneofseveralreferenceimplementationsdeprecatedaftertheprotocol’slaunch.Ofthe36npm-packagedserversobserved,6wereformallydeprecated.All6werereferenceimplementationsfromtheprotocol’soriginalscope.

Thesepackageswereintendedasexamples,butmanyorganizationsadoptedthemasproductioninfrastructure.Astheecosystemmovedtowardmaintainedvendorandcommunityimplementations,deployedconfigurationsdidnotalwaysmovewithit.

Deprecationisnotthesameasaknowncompromise.Itisamaintenancerisk.Unsupportedpackagesstopreceivingsecurityfixes,compatibilityupdates,dependencymaintenance,andprotocolrevisionswhileoftenretainingaccesstohigh-valuesystems.

04.22in3observedpackageshavenoverifiedpublisher

Packageprovenanceisaseparateproblemfrommaintenancestatus.

Ofthe36npm-packagedMCPserversobserved,25hadnoverifiedpublisher.Anunverifiedpackagemaybecurrentandfunctional,butadministratorshavelessassuranceaboutwhoproduceditorwhetheritcorrespondstothevendororprojectitclaimstorepresent.

TABLE4.OBSERVEDMCPSERVERPACKAGESBYMAINTENANCEANDVERIFICATIONSTATUS.

PACKAGE

SHAREOFORGS

LASTPUBLISHED

STATUS

@modelcontextprotocol/server-github

~45%

2025-04

Deprecated

@modelcontextprotocol/server-slack

~25%

2025-04

Deprecated

@modelcontextprotocol/server-postgres

~25%

2024-12

Deprecated

@modelcontextprotocol/server-gdrive

~15%

2025-01

Deprecated

@modelcontextprotocol/server-puppeteer

~15%

2025-05

Deprecated

@modelcontextprotocol/server-brave-search

~5%

2024-12

Deprecated

mcp-remote

~65%

2026-02

Current,noverifiedpublisher

@upstash/context7-mcp

~50%

2026-07

Current,verified

@modelcontextprotocol/server-filesystem

~35%

2026-07

Current,verified

@modelcontextprotocol/server-sequential-thinking

~30%

2026-07

Current,verified

@notionhq/notion-mcp-server

~15%

2026-07

Current,noverifiedpublisher

@playwright/mcp

~10%

2026-07

Current,verified

@sentry/mcp-server

~5%

2026-07

Current,verified

Anabandonedpackageandanunverifiedpackagepresentdifferentrisks:

Abandoned:Thesoftwareisnolongeractivelymaintained.

Unverified:Theidentityofthepublisherhasnotbeenindependentlyestablished.

Abandonedandunverified:Administratorsmayhaveneitherongoingmaintenancenorreliableprovenance.

Packagenamesalonearenotsufficientevidenceoftrust.

04.31in5organizationsrouteofficialMCP

trafficthroughanunverifiedintermediary

officialdoesnotalwaysmeandirect

Inatleast1in5organizations,agentsreachedAtlassian’sofficialMCPendpointthroughmcp-remote,acommunityproxymaintainedby2individualsandpublishedwithoutaverifiedpublisher.

Theconnectionpathwas:

Agentclient→mcp-remote→

AnetworkcontrolwatchingonlythefinaldestinationseesaconnectiontoanexpectedAtlassiandomain.Itmaynotrevealthatanadditionalpackagesitsinthepathandcanobserveorprocesstheconnection.

Thisdoesnotestablishmaliciousbehaviorbytheintermediary.Itdemonstratesthattrustcannotbedeterminedfrom

thedestinationdomainalone.Organizationsalsoneedvisibilityintothesoftwarethatestablishes,proxies,ortransformstheconnection.

04.412+agentclientslaunchMcpservers

TheMCPclientecosystemextendswellbeyondthemostcommonlygovernedIDEs.

Serverswerelaunchedbyatleast12agentclientsbeyondtheexpectedconcentrationinClaudeCode,Cursor,andVSCode.Codexappearedinapproximately40%oforganizations;Zed,ChatGPT,andcmuxinapproximately35%;and

severalJetBrainsclientsinapproximately20%–25%.

TABLE5.AGENTCLIENTSOBSERVEDSPAWNINGMCPSERVERSTHATNAME-BASEDATTRIBUTIONDIDNOTMATCH.AFLOOR—AMBIGUOUSPARENTSAREEXCLUDEDRATHERTHANCOUNTED.

AGENTCLIENTSHAREOFORGANIZATIONS

Codex

~40%

Zed

~35%

ChatGPT

~35%

cmux

~35%

Code(VSCodevariantbuild)

~30%

PyCharm

~25%

IntelliJIDEA

~25%

claude(CLIbinary)

~20%

WebStorm

~20%

Antigravity

~20%

conductor

~20%

Xcode

~20%

Agentorchestratorssuchascmuxandconductoraddanotherlayer.Asingleclientprocessmaycoordinatemultipleconcurrentagentsessions,eachwithitsownMCPservers,tools,andpermissions.

Controlling1clientdoesnotcontrolthebroaderMCPsurface.Discoverymustaccountforthefullclienttail,includingIDEs,command-lineagents,desktopapplications,orchestrationlayers,andemergingagentruntimes.

AverageMCPtool-callvolumeperorganizationgrewnearly4×fromJunetoJuly2026.Theincreasewasdrivenbymoreactivityinsideexistingorganizations,notsimplybyanincreaseinthenumberoforganizationsobserved.

05credentialsintheblindspot

Nearly50%oforganizationshavecredential-formatstringsinMCPconfigurationfiles

Secretscanninghastraditionallyfocusedonsourcerepositories.MCPconfigurationfilescreateadifferentexposurepath.

AgentconfigurationfilesarethefirstplacemanyusersputthecredentialsrequiredtoconnectanMCPservertoa

database,source-codeplatform,collaborationservice,designsystem,orcloudenvironment.Thesefilesmaylivein

user-scopedormachine-scopeddirectoriesthatarenotcommittedtosourcecontrolandarethereforenotexaminedbyrepositoryscanners.

Across1.83millionMCPconfigurationobservations,nearly50%oforganizationshadatleast1filecontainingastringmatchingaknownvendorcredentialformat.

TABLE6.CREDENTIALFORMATSOBSERVEDINMCPCONFIGURATIONFILES,BYSHAREOFORGANIZATIONS.

CREDENTIALFORMATSHAREOFORGANIZATIONS

GitHubpersonalaccesstoken

~40%

Notionintegrationtoken

~35%

PostgreSQLconnectionstring

~30%

Figmaaccesstoken

~25%

Slackbotorusertoken

~15%

AnthropicAPIkey

~15%

AWSaccesskeyID

~5%

GitLabpersonalaccesstoken

~5%

Aformatmatchdoesnotestablishthateveryvaluewasactiveatthetimeofobservation.Itdoesshowthatcredential-likematerialisfrequentlystoredinlocalMCPconfigurationfilesoutsidetherepositoriesandsecret-management

workflowswheresecurityteamstypicallylookforit.

Theobservedcredentialformatsalsomapdirectlytotheservicesagentsareconfiguredtoaccess,includingGitHub,Notion,PostgreSQL,Figma,Slack,Anthropic,AWS,andGitLab.

Environment-variableindirection—thedocumentedalternativetoembeddingavaluedirectly—appearedinfewerthan1in10credential-bearingobservations.Approximately2in3organizationsusedenvironment-variableindirection

somewhere,butwithinindividualconfigurationsitsusewasinconsistent.

Thesafepatternexists.Itisnotyetthedefault.

05.1whythesafepatternisdifficulttomaintain

Credentialsinconfigurationfilesarenotalwaystheresultofobviouscarelessness.Inseveralcases,thedocumentedsetuppathitselfencouragesunsafehandling.

AnofficialGitHubexampleplacesapersonalaccesstokendirectlyinaconfigurationheader.APostgreSQLexampleplacesadatabasepasswordinacommand-lineconnectionstring.Thesepatternsreducesetupfriction,buttheyalsocreateplaintextsecretsinconfigurationfiles,processarguments,orshellhistory.

Toolingcanalsoundoanotherwisesafeconfiguration.AreportedissuefromJanuary2026describedacommandthatreplaced${...}environment-variablereferenceswiththeirresolvedvaluesandwrotethosevaluesbackintothesharedconfigurationfile.

Aconfigurationhelpercanthereforebecomeanexposuremechanism.Itcanturnanenvironment-variablereferenceintoastoredsecret,orturnalocalconfigurationfileintoarepositoryartifactthatanotherprocesslatercommits.

Thecontrolmustcoverthefulllifecycle:

Credentialcreation→configuration→expansion→execution→storage→commit

Scanningsourcerepositoriesaddressesonlythefinalstage.

06wherecontrollives

NosinglecontrolplanecoverstheMCPsurface

MCPsecurityisincreasinglybeingdesignedaround1controlpoint:thegateway.Agatewayisvaluable,butitonlyactsontrafficthatcrossesanetworkboundary.LocalMCPserversneverdo.

Othercontrolscoverdifferentportionsofthelifecycle:

TABLE7.CONTROL-PLANECOVERAGEMATRIX.

CONTROLPLANE

DISCOVER

LOCALSERVERS

DISCOVER

LOCALSERVERS

INSPECT

CONFIGFILES

ALLOW/DENYREMOTE

TOOL-CALL

SEMANTICS

UNMANAGEDDEVICES

REAL-TIMEBLOCK

AUDIT

Endpointagent

Yes

Yes

Yes

Partial

Partial

No

No

Yes

Agentruntime-hooks

Partial

Partial

No

Partial

Yes

No

Yes—percall

Yes

Agentruntime-MCPgateway

No

Partial

No

Yes

Remoteonly

Yes

Remoteonly

Remoteonly

Management&policy(MDM,managed

config)

No

No

Partial

Yes

No

No

Atloadonly

No

Identity&

authorization

No

No

No

Partial

No

Yes

Revocationonly

Partial

Compliance/auditAPI

No

No

No

No

No

—

No

Yes

Registry&provenance

No

No

No

Partial

No

—

No

Partial

Thematrixreflectswhateachcontrolplanecanstructurallyobserveorenforce,notthecompletefeaturesetofeveryproductavailable.Endpointcontrolsandruntimehooksareshownseparatelybecausetheyoperateatdifferent

instrumentationpointsandareoftendeployedindependently.

OnlytheendpointcanreliablydiscoverlocalMCPserversandinspectlocalconfigurationfiles.Agatewaygivesbroad

visibilityintoremoteconnectionsandunmanageddevicesbutcannotreconstructlocaltoolcallsthatneverreachthe

network.Runtimehookscaninspecttoolintentandblockacallbeforeexecution,thoughtheircoveragedependsonclientsupport.Identitysystemsauthorizeaccessbutcannotinspecttoolargumentsorreturnedcontent,andregistrycontrolscanrestrictapprovedsoftwarewithoutobservingwhatarunningtooldoeswithdata.

Eachcontrolplaneisnecessary.Noneissufficientonitsown.

Effectivegovernancerequirescoordinatedcoverageacrosstheendpoint,agentruntime,network,identitylayer,managementplane,andsoftwaresupplychain.

07whatfullcoveragerequires

11requirementsforgoverningMCPactivity

Thefollowingrequirementsaregroupedbytheoutcometheyprovideratherthanbyproductordeploymentsequence.Requirements1–3establishwhatexists.Requirements4–7provideruntimevisibilityandintervention.Requirements8–11establishcoverage,authorization,andcentralizedgovernance.

TABLE8.THEMCPCONTROLREQUIREMENTS.GROUPEDBYWHATTHEYACHIEVE,NOTBYSEQUENCE.REQUIREMENTS1–3AREPREREQUISITESFORTHEREST,ANDR4VERSUSR5ISTHELINEBETWEENOBSERVINGATOOLCALLANDBEINGABLETO

STOPIT.

#

REQUIREMENT

PLANETHATSATISFIESIT

WHYNOTHINGELSEDOES

R1

Discoverlocalservers

Endpointagent

Localserversgeneratenonetworktraffic

R2

Discoverremoteservers

Endpointagent;MCPgateway

Agatewayseesthedestination,butnotwhichclient

partially

reacheditorwhatisbrokeringtheconnection

R3

Inspectconfigurationfiles

Endpointagent

Aconfigfileisafile;nonetworkcontrolseesone

R4

Seewhichtoolranandwhatit

Agentruntimehooks;MCP

Semanticsexistinsidetheagent,notonthewire

returned

gatewaypartial

R5

Stopasingletoolcallbeforeit

Agentruntimehooksonly

Interceptionmusthappeninthecallpath;telemetry

executes

reportsafterthefact

R6

Seesensitivedatainthetoolcall

Agentruntimehookslocally;

Thepayload—filecontents,queryresults,credentials—

andresponse

gatewayforremote

passesoverstdioononemachine

R7

Detectaninstructionwheredata

Agentruntimehooks,MCP

Thetrust-boundarycollapseinTable8Aisvisibleonly

wasexpected

gatewayforroutedremote-servertraffic

wherearesponseisparsedsemantically

R8

Coverdeviceswithnoagentinstalled

MCPgateway

Anendpointagentcannotseeahostitisnoton

R9

CoveragentsrunninginCIor

MCPgatewayoridentityand

Noendpointisinvolved,soneitherendpointtelemetry

hostedinthecloud

authorization

norlocalhooksapply

R10

Reduceblastradiusbeforeanythingisdetected

Identityandauthorization

Scopeandtokenlifetimearesetatgranttime

R11

Enforceanapproved-serverlist

Managementandpolicyplane

Enforcementhastooriginatesomewhereadministrators

centrally

control

Tieraccessbyinstrumentability

Therelevantdistinctionisnotwhetheraclientisapprovedbyname.Itiswhetheritsactivitycanbeobservedandcontrolled.

Aclientwithoutruntimehooksmaystillsupport:

—R1–R3throughendpointdiscoveryandconfigurationinspection

—R4throughgatewaycoveragewhentrafficcrossesthenetwork

WhatitcannotprovideisR5:stoppingatoolcallbeforeexecution.

Clientswithoutpre-executioncontrolsshouldthereforeoperateundertighterrestrictions.Theyshouldnotreceiveunrestrictedshellaccess,credential-bearingservers,productiondata,orbroadaccesstosensitivesystems.

Oncethesameclientmovesontoanunmanageddevice,evenendpointvisibilitymaydisappear.Atthatpoint,the

organizationmayretainauthorizationrecordsornetworktelemetrywithoutknowingwhichlocalserversarerunningorwhattheagentisdoingwithretrieveddata.

operatingpractice

01Discover.InventoryeveryagentandeveryMCPserver