Choose self-hosted when data residency, internal security policy, or regulated compliance mandates require full control over identity and runtime decisions. Choose SaaS only if the vendor-hosted management plane and data processing are acceptable under policy. If the control boundary is unclear, treat it as a governance risk, not a convenience trade-off.
Why This Matters for Security Teams
The SaaS versus self-hosted choice for MCP is really a control-boundary decision: who can see tool traffic, who can change policy, and who can revoke access when something goes wrong. That matters because MCP servers often sit between agents and valuable systems, so the management plane becomes part of the attack surface, not just an admin convenience. Current guidance from the OWASP Agentic AI Top 10 treats over-permissioned agent tooling as a core risk, and NHIMG research on the State of MCP Server Security 2025 found 53% of MCP servers expose credentials through hard-coded values in configuration files. In practice, many security teams discover the boundary problem only after an integration has already been connected to sensitive systems.
How It Works in Practice
Organisations should decide by mapping the MCP deployment to the data, identity, and operational controls that apply to it. SaaS MCP can be acceptable when the vendor-hosted control plane, telemetry, and support access are within policy, and when the organisation can still enforce strong identity, logging, and tenant isolation. Self-hosted MCP is the safer default when the organisation needs direct control over secrets handling, runtime isolation, network egress, audit retention, or jurisdictional constraints.
The practical test is whether the provider can prove how identities are authenticated, how tool permissions are scoped, and how quickly access can be revoked. That is why many teams pair the decision with workload identity patterns, ephemeral secrets, and policy-as-code rather than trust informal admin settings. The model in the OWASP Agentic Applications Top 10 is useful here because agentic systems fail when access is broad, persistent, and hard to inspect. For implementation detail, the OWASP Top 10 for Agentic Applications 2026 reinforces that tool access should be minimized and monitored at runtime, not assumed safe because it is “managed.”
- Use SaaS only if the vendor contract, tenant isolation, logging, and data handling satisfy the same policy you would apply internally.
- Use self-hosted when secrets, prompts, tool calls, or outputs may include regulated data, production credentials, or internal system paths.
- Require explicit ownership for identity, logging, patching, and incident response before any MCP server is allowed to connect to privileged tools.
These controls tend to break down when development teams connect MCP to production systems through shared credentials and no central approval path.
Common Variations and Edge Cases
Tighter control over MCP often increases operational overhead, so organisations have to balance speed of adoption against auditability and blast-radius reduction. That tradeoff becomes sharper in multi-team environments where one group wants SaaS for convenience while another is accountable for regulated data exposure.
There is no universal standard for this yet, but current guidance suggests a simple rule: if the management plane can influence production access, it should be treated like a privileged component. That is especially true for environments with high secret density, because NHIMG’s State of MCP Server Security 2025 shows how often MCP configurations leak credentials. For similar reasons, incidents such as the Salesloft OAuth token breach and the BeyondTrust API key breach are reminders that third-party control planes can become high-impact trust anchors.
Hybrid models are common: organisations may self-host sensitive MCP servers while allowing SaaS for low-risk internal use cases. That approach is reasonable, but only if the boundary is documented, reviewed, and enforced technically rather than left to team preference.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Covers identity and secret exposure risks in MCP deployments. |
| OWASP Agentic AI Top 10 | A2 | Agent tool access expands attack paths when MCP is over-permissioned. |
| CSA MAESTRO | MAESTRO-TRUST-01 | Addresses trust boundaries and control-plane governance for agentic systems. |
| NIST AI RMF | AI RMF applies to governance and accountability for autonomous tool use. | |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero trust supports explicit verification of MCP control-plane access. |
Classify each MCP server as an NHI asset and minimize exposed secrets, tokens, and standing credentials.
