Claude security now depends on governing tools, skills, and MCP

At a glance

What this is: This is Cato Networks’ analysis of how AI security must extend from chat into Claude’s agentic workflows, with emphasis on controlling skills, MCP servers, and tool use.

Why it matters: It matters because IAM, NHI, and security teams now need to govern agent actions, not just user authentication or endpoint access, or they will miss the control plane where AI work actually happens.

By the numbers:

• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.

👉 Read Cato Networks' analysis of AI security controls for Claude workflows

Context

Claude’s expansion from chat into code execution, collaboration, and agent workflows changes the primary identity question. The issue is no longer only whether a person is authenticated. It is whether the system can govern the tools, skills, and prompts that shape what the agent is able to do in runtime.

For identity teams, that creates an NHI governance problem with agentic characteristics. Skills, MCP servers, and tools extend the actor’s reach into data sources and business workflows, which means policy has to follow the interaction path rather than stop at sign-in or coarse network boundaries.

The article’s central point is that security controls need to be available from the first supported session and must preserve auditability across user, device, prompt, and tool activity. That starting position is typical for modern AI adoption, which means many organisations are already facing the same control gap.

Key questions

Q: How should security teams govern AI agents that use service accounts and MCP tools?

A: Start with ownership, then add runtime attribution and containment. Security teams should know which human deployed the agent, which identity the agent uses, what tools it can invoke, and when to revoke access. If the agent can chain tool calls or spawn sub-agents, governance must cover those paths as well, not just the initial login.

Q: Why do AI agents create a different risk model than chatbots?

A: AI agents can act, not just generate. Once they can browse, retrieve, call tools, and complete tasks, the main risk shifts from unsafe output to unsafe action. That expands the attack surface from prompts to workflows, credentials, and downstream systems, which is why traditional model-only controls are no longer enough.

Q: What do security teams get wrong about MCP and tool governance?

A: They often review each integration in isolation and miss the combined permission path. Two legitimate tools can create a new capability that neither one should have alone. Governance has to assess the full chain of action, because risk emerges from composition as much as from individual access rights.

Q: How do organisations know if agent security controls are actually working?

A: Look for evidence that the platform can inspect traces, classify risky actions, and stop unsafe tool use before completion. Effective controls leave an audit trail that shows why the action was allowed or denied, and they reduce false positives enough that teams can trust them in production.

Technical breakdown

Inference hooks and runtime policy enforcement for Claude

Inference hooks create a policy checkpoint before prompts and tool calls reach the model. That matters because agentic systems do not just generate text, they may select tools, call services, and pass data onward. If governance is limited to network inspection or post-event logging, the important decision already happened. Runtime enforcement has to examine the interaction while the session is still live, then preserve an audit trail across the prompt, model output, tool input, and tool output. This is the control layer that turns AI visibility into usable governance.

Practical implication: place policy at the interaction boundary, not only around the network or the endpoint.

Skills, MCP servers, and tool chains as NHI attack surface

Skills and MCP servers act like capability amplifiers. They expand what the agent can reach and what it can trigger, which means they also expand the identity and access surface. The security problem is not just malicious code. It is capability composition, where individually legitimate integrations combine into an unsafe path because their permissions exceed the task. In NHI terms, this is permission amplification through delegation. A benign-looking tool can become a control bypass when an agent is allowed to stitch multiple capabilities together during execution.

Practical implication: inventory tool chains as identity-bearing access paths, not as isolated integrations.

Scoped rollout, attribution, and first-use protection

Operationally, the article highlights a familiar identity failure mode: controls that arrive after adoption create a blind spot at the most dangerous moment, the first use. Scoped rollout reduces blast radius, but only if policy and audit records tie actions to the correct user and device identity. That matters because weak attribution breaks accountability and slows incident analysis. For security teams, deployment mechanics are part of governance. If the control cannot be validated before broad use, the programme is relying on hope rather than enforcement.

Practical implication: verify attribution and enforcement before expanding agent access beyond a pilot group.

Threat narrative

Attacker objective: The objective is to turn a legitimate AI workflow into an execution path that can move data or actions outside intended governance boundaries.

1. Entry occurs when an employee adopts a Claude workflow that can use skills, MCP servers, or tools to reach business systems and data.
2. Escalation occurs when the agent combines multiple capabilities and inherits permissions greater than the original task requires, creating a wider action surface.
3. Impact occurs when the agent is able to read, modify, or transmit information in ways security teams did not anticipate at approval time.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Tool governance is now identity governance. When an AI system can call skills, MCP servers, and downstream tools, the security question moves from authentication to delegated capability control. The same actor can expose very different risk depending on which tools it can reach, so entitlement review must include the action surface, not just the login surface. Practitioners should treat agent tools as NHI-bearing privileges, not as optional app features.

Capability composition is the new privilege problem. The article shows how individually legitimate tools can combine into an unsafe path when their combined permissions exceed the task. That is a classic least-privilege failure, but in AI systems the failure is easier to miss because the composition happens dynamically at runtime. Identity teams should recognise this as privilege amplification through tool chaining.

Runtime enforcement beats post-hoc review for agent workflows. Traditional logging can show what happened after the fact, but it cannot stop a tool call that is already in flight. The important control point is before prompt, before tool invocation, and before output is passed onward. For AI programmes, that makes pre-execution governance the decisive control model.

Capability-to-action policy needs a named concept: tool-surface governance. This is the discipline of governing not only what an agent is allowed to access, but which combinations of tools, skills, and connectors it can assemble during a session. It matters because the real risk is often not a single dangerous permission, but a chain of harmless-looking permissions that become risky together. Security teams need to review the full tool surface as one identity system.

Identity attribution must survive deployment friction. If audit records point to the wrong client identity or a subscription identity instead of the real user and device, accountability becomes weak exactly where AI usage is moving fastest. That is a governance failure, not just an operational nuisance. Practitioners should assume every control is incomplete until attribution is reliable end to end.

From our research:

• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• Our research also found that lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, with inadequate monitoring and logging at 37%.
• For a broader control model, see OWASP Agentic Applications Top 10 for how tool misuse and prompt-driven abuse map to agentic risk.

What this signals

Tool-surface governance will become a standard identity control pattern as AI systems move from passive assistants to active workflow participants. Security teams should expect their current access review processes to miss this surface entirely unless they map skills, MCP servers, and tool chains as governed entitlements.

The strongest programmes will treat attribution as a control, not a reporting detail. If the organisation cannot tie prompt, tool use, and device identity back to a real actor, then auditability and accountability will fail at the same time, which is a poor foundation for any AI rollout.

With only 1.5 out of 10 organisations highly confident in securing NHIs, the governance gap is already visible in machine identity programmes. The next step is to extend that discipline to agentic workflows before tool composition becomes the default attack path.

For practitioners

• Inventory agent tool chains as governed access paths Map every skill, MCP server, and connected tool an agent can invoke, then classify the resulting action path by data sensitivity and business impact.
• Enforce policy before tool invocation Require runtime checks on the prompt, model output, tool input, and tool output so approval happens before the agent can execute an unsafe action.
• Scope rollout to named users and devices first Start with tightly limited groups and verify that client identity, endpoint identity, and audit records all resolve to the correct actor before broad deployment.
• Review tool combinations for privilege amplification Test whether two legitimate tools, when combined in one session, create a capability that exceeds the intended task or policy boundary.
• Validate first-use protection in agent pilots Confirm that the first session on a new device is covered by policy and logging before moving the workflow into production use.

Key takeaways

• Claude’s move into agentic workflows shifts AI security from conversation monitoring to control over delegated action.
• The operational risk is not a single dangerous tool, but the way legitimate tools combine into an unsafe permission chain.
• Security teams need runtime policy, trustworthy attribution, and scoped rollout before AI adoption outruns governance.

Key terms

• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Tool-Surface Governance: Tool-surface governance is the discipline of controlling the full set of tools, connectors, and skills an AI system can assemble during execution. It focuses on capability combinations, not just individual permissions, because risk often appears when legitimate components are chained together in one session.

What's in the full article

Cato Networks' full post covers the operational detail this post intentionally leaves for the source:

• Specific deployment options for Claude Enterprise, Claude Code, and Claude Cowork in Cato's security stack
• Workflow details for Cato Scout, including custom settings, plugin installation, and hook verification
• Operational guidance for scoped rollout, attribution, and first-use protection across supported agents
• Examples of how runtime policy is applied to prompts, responses, tool input, and tool output

👉 Cato Networks' full post covers deployment mechanics, runtime enforcement, and scoped rollout details for Claude.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.