MCP security from server discovery to every tool call
Discover MCP servers and tools, bind them to accountable owners, authorize tool calls at runtime and retain evidence for every consequential decision.
The problem
What this is actually about
MCP makes tools easier to connect, which also makes authority easier to spread. An unreviewed server can expose powerful operations, inherit broad credentials, and become available to many agents before security knows it exists.
Authentication establishes a caller and server. Governance still has to decide which tool that caller may invoke, against which resource, under whose delegated authority, and whether the operation should be denied or approved by a person.
What the platform does about it
Read from the product architecture rather than written here, so this page cannot promise something no module ships.
What AI agents exist here?
- Connectors across AI platforms, cloud, identity providers, source control, enterprise applications and infrastructure
- Shadow agent discovery from model API traffic, AI keys, MCP configuration, SDK dependencies and automation credentials
- An inventory record per agent: owner, purpose, model, framework, tools, MCP servers, data sources, permissions and secrets
- Ten lifecycle statuses from Discovered through Quarantined and Retired
Which MCP servers does it use, and what do they grant?
- A registry of MCP servers with publisher, version, hosting, tools, resources, scopes, data access and the agents using each
- An approval path from discovery through publisher verification, tool inventory, permission analysis, scan and risk score
- Per-tool risk classification, because search_files and run_shell are not the same grant
- Permission drift detection when a server quietly adds a capability it did not ship with
What is this agent allowed to reach?
- Role and attribute rules evaluated with agent, user, tenant, data, tool, environment, time, risk and declared purpose in context
- Action-level permissions, so reading a supplier and changing its bank details are separate grants
- Five sensitive action classes from read through draft, reversible execution, human approval and dual approval
- Just-in-time privileges that are issued for one action and expire rather than accumulating
- A credential broker that issues scoped, short-lived secrets on request, so an agent never holds a permanent key
What is the record, and can it be trusted?
- An append-only record of agent, user, session, resource, action, policy, decision, tool, model, result and risk
- Customer-configurable retention from 30 days to seven years
- Tenant isolation on every record, so no agent can read across the boundary
- Event-driven telemetry that keeps the authorization path fast and synchronous while analytics runs behind it
What it leaves behind
The artefacts these modules produce. Evidence generated by a decision, rather than assembled for an audit afterwards.
- A first-day discovery report naming agents nobody had registered
- An unregistered-agent alert with provider, data reach and risk
- An approval record per server, and the agents that depend on it
- A reauthorization demand when a server materially changes
- A permission inventory showing where an agent exceeds its purpose
- An expiry on every elevated grant
- A credential ledger: which agent held what, against which system, and when it lapsed
- The evidence every other module cites
- A retention position the auditor can check
See it working
Every claim above has somewhere on this site you can go and check it.
- Review MCP controls
Inspect registry, trust, tool-policy and evidence capabilities derived from the module model.
- Watch tool enforcement
See malicious instructions reach a tool boundary and fail policy.
- Inspect decision evidence
See the normalized record produced by governed actions.
Common questions
- Does MCP authentication authorize every tool?
- No. Authentication identifies a party. Each tool call still needs authorization against its operation, arguments, target resource and delegated purpose.
- What belongs in an MCP registry?
- Server owner, environment, transport, authentication method, exposed tools, downstream credentials, trust state, review date and the agents allowed to connect.
- Can MCP tool calls require approval?
- Yes. Policy can allow routine calls, deny prohibited ones, or pause consequential and irreversible calls for a named approver.