Enterprise MCP governance is now mandatory for scaled AI agents

At a glance

What this is: This analysis says enterprise MCP governance is becoming mandatory for scaled AI agents because tool discovery, authorisation, observability and lifecycle control all need a common control plane.

Why it matters: IAM, NHI and platform teams need this because agent sprawl turns every ungoverned tool connection into an access, trust and audit problem, not just an integration issue.

Context

MCP governance is the problem of controlling how AI agents discover, request and use tools across an enterprise. At Uber scale, the issue stops being integration convenience and becomes identity governance, because every agent-tool connection needs authorisation, traceability and lifecycle control.

The article argues that without a standard interface and registry, organisations accumulate bespoke agent integrations that are hard to secure, hard to version and hard to observe. That creates governance gaps for both the humans who build agents and the non-human identities those agents depend on.

The core lesson for enterprise AI programmes is that MCP is no longer an experimental protocol layer. Once agents reach production scale, the control question shifts from whether the model works to whether the organisation can govern every delegated action it enables.

Key questions

Q: What breaks when AI tools are exposed through loosely governed MCP servers?

A: Loose governance lets model-driven tools cross from context retrieval into state-changing actions without enough oversight. That can expose sensitive data, trigger unauthorized system changes, or widen lateral movement paths. The failure is a control boundary mismatch between what the AI can ask for and what it can safely do.

Q: Why do unmanaged MCP servers create risk for enterprise AI programmes?

A: Because every unmanaged server expands the number of reachable actions without a corresponding governance record. That creates exposure in discovery, authorisation and observability at the same time. Once an agent can reach a tool that nobody formally owns, the organisation loses the ability to prove scope, enforce policy or revoke access cleanly.

Q: How do security teams know whether MCP server governance is working?

A: They should be able to answer four questions at any time: what servers exist, which are official, what credentials they can use, and what systems they contact. If those answers are unclear, governance is not working. The signal is not just fewer alerts, but clear attribution and scoped access across the fleet.

Q: How should teams govern skills and MCP together in production?

A: Treat MCP as the protocol boundary and skills as governed instruction assets. That means separate ownership, approval, versioning, and audit for each layer. If an agent can load a skill and then act through an MCP server, both layers need lifecycle controls, because a safe tool can still be used unsafely when the instruction layer is unmanaged.

Technical breakdown

Why a central MCP registry becomes the control point

MCP turns many-point integrations into a standard tool layer, but standardisation only helps if the enterprise can also govern what is published, discovered and invoked. A registry gives teams a source of truth for tool definitions, versions, ownership and trust state. Without that control point, every agent can end up with a different view of the available tool set, which makes policy enforcement inconsistent and audit evidence incomplete. In practice, the registry becomes the identity boundary for machine-to-tool access, not just a catalog.

Practical implication: treat the MCP registry as an access governance system, not a convenience layer, and require ownership, versioning and approval on every published tool.

How gateway enforcement changes agent authorisation

An MCP gateway sits between agents and services so that tool use can be mediated rather than assumed. That matters because agent behaviour is not just read-only retrieval; agents can invoke mutable endpoints, touch sensitive data and trigger workflows. Gateway enforcement can add authentication, redaction, rate limits, endpoint allowlists and guardrails around write paths. It can also create the logs and traces needed to prove which agent used which tool, under what scope, and with what effect. In identity terms, the gateway is where delegated intent becomes enforceable access.

Practical implication: enforce tool access at the gateway, with explicit allowlists for mutable actions and full traceability for every agent invocation.

Why skills registries create a second governance layer

A skills registry goes beyond single tools by packaging multiple MCPs into reusable task flows. That changes the governance problem because security now has to assess not only a tool’s permissions, but also the combined behaviour of the workflow it participates in. Skill evaluation, quality scoring and invocation testing become governance signals, because a safe tool can still produce unsafe outcomes when chained into a higher-order action. This is where agentic AI governance starts to resemble lifecycle management for executable capabilities, not static integrations.

Practical implication: govern skills as composite access constructs, with evaluation criteria for both tool correctness and workflow-level side effects.

Threat narrative

Attacker objective: The objective is to get an agent to reach and use enterprise tools in ways the organisation cannot fully authorise, observe or constrain.

1. Entry occurs when an AI agent discovers an MCP server or connected tool through an ungoverned or poorly curated interface.
2. Privilege expands when the agent is allowed to invoke mutable tools or third-party servers without a strong policy gate or scope restriction.
3. Impact follows when tool misuse, excessive access or unobserved execution creates data exposure, unsafe workflow actions or uncontrolled agent behaviour.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Uber breach 2016: An AWS key posted to Uber's private GitHub repositories let intruders copy data on 57 million people; Uber paid $100,000 and hid it for a year.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Enterprise MCP governance is an identity control problem, not just an integration problem. Once agents can discover tools dynamically, the enterprise is no longer managing a fixed connection map. It is managing delegated access paths that need ownership, authorisation and revocation logic. The practical conclusion is that MCP governance belongs in the identity operating model, not beside it.

MCP registries are becoming the control plane for non-human access. A registry does more than list servers. It creates the authoritative record for what exists, who owns it, what version is live and what trust state it carries. That makes it structurally similar to an access catalog for machine identities, and it should be governed with the same discipline as other non-human identity inventories.

Skills registries add a new layer of governance because they combine multiple tools into executable behaviour. A single safe MCP server can still participate in a risky skill if the workflow chains together sensitive actions or mutable endpoints. That means the enterprise must assess composite behaviour, not just point integrations. The practitioner takeaway is to govern skills as access-bearing assets in their own right.

Enterprise MCP strategy now exposes the limits of ad hoc agent onboarding. The article’s scale data shows that once tool use becomes mainstream, manual exceptions and bespoke integrations collapse under their own weight. That shifts the market toward centralised governance patterns, stronger discovery controls and policy enforcement at the interface layer. The implication is that scaled agent programmes will converge on managed control planes, whether they build them or buy them.

What this signals for the market is a move from agent experimentation to governed delegation. The industry is leaving the phase where tool use was a developer convenience and entering the phase where every agent action is a governed enterprise event. For IAM, PAM and NHI teams, that means agent access can no longer be treated as a side channel. It is becoming a primary governance surface.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Maturity Model

What this signals

MCP governance is converging with identity governance: once agents consume tools through a shared protocol, the enterprise has to manage ownership, authorisation and revocation as one control surface rather than three separate problems. That makes registry quality and gateway policy more important than isolated integration speed.

Agentic AI programmes will increasingly be judged by control quality, not deployment volume: large numbers of agents and tool connections only create value when the organisation can prove which actions are permitted, observable and reversible. The practical signal is that teams should prioritise governed publishing, not just agent creation.

Skills registries will become a meaningful governance layer: once reusable workflows sit on top of MCP, security has to assess composite behaviour, not just tool permissions. That shifts the programme from connection management to delegated capability management, which is a harder but more durable operating model.

For practitioners

• Define MCP ownership and publishing rules Require every MCP server to have a named owner, version history and approved tool scope before it can be discovered by agents.
• Enforce gateway mediation for mutable tools Place a policy layer between agents and services so write operations, sensitive endpoints and third-party tools can be blocked or rate-limited.
• Inventory agent-facing tools and skills together Track MCP servers, the agents that consume them and any composite skills that chain multiple tools into one workflow.
• Instrument full invocation telemetry Capture logs, metrics and traces for tool discovery, selection and execution so you can prove which agent did what and when.
• Review third-party MCP trust before rollout Apply a stricter review path to external MCPs than to first-party tools, including data handling, permission scope and revocation criteria.

Key takeaways

• Scaled AI agent programmes fail quickly when MCP access is treated as an integration detail rather than a governed access surface.
• Registry, gateway and observability functions are the practical controls that let enterprises see, limit and audit agent tool use.
• The next governance challenge is no longer just connecting agents to services, but controlling the reusable skills those connections enable.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• MCP Gateway: The control layer that relays assistant intent to tools and data sources through the Model Context Protocol. In practice, it becomes a policy boundary, not just a transport layer. If it trusts model output too early, it can turn unverified reasoning into real-world execution or disclosure.
• Mcp Registry: An MCP Registry is a catalog that lists available Model Context Protocol servers, tools, and resources for AI agents to discover and use. It typically stores metadata such as endpoints, capabilities, ownership, and trust information, helping organizations govern which tools agents can access and how those connections are managed.
• Skills Registry: A catalog of reusable multi-tool workflows that an agent can invoke to complete a task. It extends governance from single tool access to packaged action sequences, which means evaluation, approval, and revocation need to follow the skill itself, not just the underlying tools.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.