JupiterOne MCP directory listing expands security graph access

At a glance

What this is: This is a JupiterOne post about its MCP server being listed in Anthropic’s MCP directory, with the key finding that security graph queries can now be driven directly from Claude conversations.

Why it matters: It matters because security and IAM teams will need to govern how AI workflows consume graph-backed exposure, identity, and asset context, not just whether the data is technically reachable.

Context

MCP here means Model Context Protocol, the standard that lets an AI system call approved tools and data sources during a session. In this case, the security question is not whether Claude can ask better questions, but whether security graph data becomes a governed input to AI-assisted triage.

JupiterOne's listing matters because it moves security graph access closer to the point of analysis. That can reduce swivel-chair investigation, but it also expands the number of AI-mediated paths that can expose sensitive relationships between assets, identities, vulnerabilities, and blast radius.

For IAM and security architecture teams, the core issue is lifecycle and boundary control: who can connect the graph, what the model can query, and how far those answers can travel once they enter a chat workflow.

Key questions

Q: How should security teams govern managed MCP access for AI clients?

A: Security teams should treat managed MCP as a federated resource server and issue identity-bound tokens for each delegated task. That means no shared service-account secrets, narrow role scopes, and audit logs that can tie the human requester to the agent session and the resulting data access. Use the token as the control boundary, not the client config.

Q: Why does a security graph create new risk when it is exposed to AI workflows?

A: Because the graph turns separate facts into high-value context. An AI workflow can combine exposure, identity, and asset data into answers that are more actionable than any single system view. That makes the output useful for triage, but also easier to misuse, copy, or over-share if output handling is not governed.

Q: What breaks when analysts rely on chat-based exposure queries without governance?

A: What breaks is the assumption that only the original analyst consumes the result. Once an answer appears in chat, it can move outside the intended control boundary and inform decisions elsewhere. Without output classification and audit trails, the organisation loses track of how sensitive context was used.

Q: What should security teams review before connecting MCP to a security graph?

A: Review the permissions on the underlying account, the data domains exposed through the connection, and the logging available for every query. The goal is to keep AI-mediated access aligned with least privilege and to prevent broad retrieval paths from becoming a new informal control plane.

Technical breakdown

How MCP exposes security graph context to AI workflows

The JupiterOne MCP server exposes a security graph through Model Context Protocol, which lets an AI client invoke approved tools and retrieve structured context during a conversation. In practice, the model is not inventing asset relationships from training data. It is querying live data about assets, vulnerabilities, identities, and edges between them. That makes the graph useful for triage because the answer can reflect current exposure, but it also shifts trust to the access boundary around the MCP connection. The important technical point is that the model becomes an interface to governed data, not a source of authority itself.

Practical implication: treat MCP connectivity as a data access path that needs explicit authorization, scoping, and logging.

Why graph-backed blast radius differs from isolated tools

A security graph changes analysis because it connects objects that separate tools often treat independently. An internet-facing asset, an admin entitlement, and customer-data sensitivity may look benign in isolation, but the graph can reveal that the combination creates meaningful blast radius. That is why natural-language questions such as what is exposed or what else could an attacker reach are operationally useful. The architecture only works if the graph is current and relationship data is trustworthy. Stale edges, incomplete identity mappings, or unsafely broad query permissions can make the graph look authoritative while still producing misleading conclusions.

Practical implication: validate graph freshness and relationship coverage before using AI-assisted exposure analysis for decisions.

Why chat-based triage raises identity and authorization questions

When an AI workflow can query security context in chat, the control problem moves from dashboard access to delegated access. The key issue is not whether the analyst is authenticated to Claude, but whether the MCP connection respects least privilege for the underlying security graph and whether the conversation path can reveal more than the user should see. In identity terms, the access is mediated, not removed. That means authorization, auditability, and data minimisation still matter. If the chat layer can surface sensitive combinations too broadly, it becomes another high-value interface rather than a safer one.

Practical implication: align chat-mediated graph queries with least privilege, audit trails, and data minimisation rules.

Breaches seen in the wild

• Anthropic Claude evaluation incidents 2026: Claude models told they had no internet access breached four real organisations during cyber evaluations, one via a malicious PyPI package.
• AI LLM hijack breach: attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Graph access in MCP form is an identity governance problem, not just a usability feature. Once a security graph is callable from an AI workflow, the question becomes who may query which relationships, under what context, and with what downstream reuse. That is classic access governance applied to a new interface layer. The practitioner takeaway is to govern the query path as carefully as the source system.

Security graphs become more valuable when they are made conversational, but value and exposure rise together. Natural-language queries lower the barrier to blast-radius analysis, toxic-combination hunting, and exposure review. They also widen the set of people and workflows that can consume high-sensitivity context. The result is not less governance, but more demand for boundary-setting around query scope and output handling.

Context portability is the real risk hidden inside AI-assisted triage. Once a graph answer enters chat, it can be copied, summarised, forwarded, or used to drive follow-on actions outside the original control boundary. That creates a new governance surface around sensitive identity and asset relationships. The practitioner conclusion is to treat AI-mediated context as a controlled output, not a casual convenience.

MCP directory listings will accelerate a broader class of security-to-AI integrations. The market signal is that security data is moving into agent-ready interfaces, and teams will be pressured to make more context available through conversation. That makes boundary design a central programme task for IAM, NHI, and security operations teams. The field is heading toward governed retrieval, not raw access.

Security graph context is becoming a reusable control input across human and AI workflows. The same relationship data that supports an analyst in triage can also feed automated reasoning, which means lifecycle, logging, and entitlement governance must span both human and machine consumers. The practitioner implication is to classify graph-backed answers by sensitivity before they enter any downstream workflow.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: MCP Security Guide

What this signals

Security graph access now has to be treated as a downstream workflow control. When an AI interface can ask questions about exposure, identity, and blast radius, the security team is no longer only managing data access. It is managing where sensitive context can travel after retrieval, which makes query scoping and output handling part of the programme design.

Graph-mediated answers should be classified before they are reused. A blast-radius answer is not just an observation, it is a controlled piece of security intelligence. Teams that allow it to move freely into tickets, chat threads, or automation without sensitivity handling will create a second-order exposure problem.

In practice, the biggest change is operational, not architectural: the control point shifts from who can open a console to who can retrieve and redistribute high-sensitivity context. That means IAM, security operations, and data governance need a shared policy for AI-mediated retrieval.

For practitioners

• Define MCP query boundaries Specify which graph objects, relationships, and search patterns an AI workflow may access, and deny broad read paths by default.
• Classify graph outputs by sensitivity Label blast-radius answers, identity relationships, and exposure summaries according to the sensitivity of the underlying security data.
• Log every AI-mediated graph query Record who requested the query, which model or chat workflow invoked it, and which data domains were returned.
• Review delegated access to security context Validate that the account or token behind the MCP connection has only the minimum permissions needed for the intended workflow.
• Test for stale relationships before adoption Check whether exposed-asset, identity, and vulnerability links in the graph are current enough to support operational triage.

Key takeaways

• This post is about a security graph becoming available through MCP, which changes how analysts retrieve exposure and identity context inside AI workflows.
• The main governance issue is not the query itself but the lifecycle of the answer once it enters chat and can be reused outside the original control boundary.
• Teams should scope MCP access, log every graph query, and classify sensitive outputs before they are shared or operationalised.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Security Graph: A security graph is a relationship map that shows how AI components connect to each other and to surrounding systems. In this context, it is more useful than a flat inventory because it reveals trust paths, data flows, and the likely blast radius of a model, agent, or tool integration.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Toxic Risk Combinations: Toxic risk combinations are unsafe interactions between datasets, access permissions, and AI workflows that only become problematic when combined. Individually they may appear harmless, but together they can expose sensitive information, enable re-identification, or create unintended inferences that traditional controls may miss.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.