MCP harness design matters more than the protocol itself

At a glance

What this is: This is a Corelight analysis of building MCP for an AI SOC, with the central finding that the surrounding harness, retrieval design, and governance controls matter more than the protocol itself.

Why it matters: It matters because AI SOC and agentic workflows only become operationally safe when identity, permissions, trace review, and drift controls are designed around the harness, not assumed from the protocol.

Context

MCP is a way for models and agents to reach tools and data sources, but the real security problem is how those interactions are governed once they leave the demo environment. In an AI SOC, the hard part is not asking the model to do work; it is making sure every retrieval, tool call, and workflow step is attributable, bounded, and reviewable. That is why the harness matters more than the protocol itself, and why MCP security is the right starting point for operational design.

Corelight's analysis frames the issue as a governance problem as much as a technical one. Playbooks become skills, retrieval becomes dynamic, and autonomous workflows start adapting to evidence in real time, which means permissioning, observability, and drift control become part of the control plane rather than an afterthought.

Key questions

Q: How should teams govern AI agents that use MCP?

A: Treat each connected agent as a non-human identity with an owner, a scope, and a review cycle. The practical control set is familiar: least privilege, secret rotation, access expiration, and auditability across the systems the agent can reach.

Q: Why do self-improving security agents create operational risk?

A: Self-improving agents can drift away from the approved behaviour they started with, especially when changes are driven by traces and no one reviews the resulting code or workflow updates. The risk is not just bad output, but silent behavioural change. Organisations need version baselines, human review of proposed changes, and clear rollback paths for any learned workflow.

Q: What breaks when AI investigations rely only on embedding-based retrieval?

A: Embedding-only retrieval can miss structure, sequence, and windowed change, which are often the real clues in security investigations. That means an agent may sound confident while skipping the evidence pattern that actually matters. Teams should combine retrieval methods so the system can answer different kinds of evidence questions, not just semantic similarity questions.

Q: How should teams decide between a central orchestrator and peer-to-peer agent communication?

A: A central orchestrator is easier to inspect, constrain, and audit than a mesh where every agent can talk to every other agent. For security operations, that usually produces better control over sequencing and permissioning. Peer-to-peer designs may look flexible, but they often make authorisation, attribution, and containment harder to reason about.

Technical breakdown

Why bounded agent workflows are safer than free-form automation

The article describes a harness where specialised agents do narrow jobs under orchestration rather than every agent talking to every other agent. That design matters because AI systems in security operations need task boundaries, not open-ended autonomy. A hunting agent, a validation agent, and an incident response agent can each operate with a constrained purpose while the orchestrator controls sequencing and permissions. The architecture is closer to delegated execution than to generic chatbot automation, which is why governance has to sit at the workflow layer. Practical implication: keep agent capability scoped to specific jobs and enforce a single orchestration layer for permissioned execution. See the AI Agent Authorisation Guide.

Practical implication: keep agent capability scoped to specific jobs and enforce a single orchestration layer for permissioned execution.

How retrieval patterns change what an AI SOC can prove

Corelight contrasts SQL retrieval, tree-structured document traversal, and chunk summarisation because different evidence problems need different retrieval paths. SQL works when the data is already queryable, PageIndex-style navigation works when structure matters, and summarisation helps surface anomalies and behavioural signals across windows of activity. The security point is that embedding-only retrieval is not enough for investigations that depend on sequence, change, or structural context. If the retrieval layer cannot preserve investigative logic, the model can appear fluent while still missing the thing that matters. Practical implication: design retrieval around the evidence question, not around one generic vector search pattern. See the Agentic AI Security Guide.

Practical implication: design retrieval around the evidence question, not around one generic vector search pattern.

Why agent drift becomes a governance failure

The article treats drift as the moment a self-improving agent keeps learning after it should have stabilised. That is an identity and governance issue because the system's behaviour changes without equivalent change control. A model that rewrites its own query logic can silently move outside the intent that approved it, especially when traces are the only source of feedback. Watching for deviation from a rolling baseline is therefore a control, not a convenience. Practical implication: freeze stable agent versions, review proposed changes before release, and treat behavioural drift as a governed lifecycle event. See the Agentic AI Identity Maturity Model.

Practical implication: freeze stable agent versions, review proposed changes before release, and treat behavioural drift as a governed lifecycle event.

Threat narrative

Attacker objective: The end state is not necessarily a traditional external breach, but an investigation environment that can be steered, misled, or made unreliable through over-permissioned and poorly governed agent behaviour.

1. Entry occurs when an MCP-enabled AI workflow is connected to live security data, tools, and telemetry sources that the agent can query and act on.
2. Credential access and escalation happen when the harness allows broad tool use or overly permissive permissions, giving the agent more authority than its task requires.
3. Impact appears when a drifting or poorly governed agent returns false conclusions, misses compromise evidence, or silently changes investigation behaviour in production.

Breaches seen in the wild

• Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP governance is really harness governance: the protocol is only the transport layer for tool use, while the security outcome depends on how identity, permissions, evidence, and orchestration are controlled around it. That is why SOC teams should assess the wrapper first, because the wrapper decides whether the model can act safely at all.

Agentic SOC design should privilege bounded delegation over open-ended autonomy: the article's multi-agent shape is the right way to think about operational AI, but only if each role has narrow authority and a single orchestrator governs sequencing. AI agent authorisation is the right mental model here, because the hard question is not whether an agent can act, but what it is allowed to touch.

Retrieval quality is now a governance issue, not just an accuracy issue: when agents choose retrieval paths dynamically, the evidence model changes with them. That means investigators need provenance, traceability, and enough control over retrieval patterns to explain why a conclusion was reached, not just whether it sounds plausible.

Agent drift is a lifecycle problem disguised as an optimisation problem: once a self-improving system starts rewriting its own behaviour, approval cannot stay static. The governance assumption that a learned workflow will remain stable is wrong, and programmes need change control for agent behaviour in the same way they already manage software baselines.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Traceability is becoming the new control surface: when agents can rewrite workflows and choose retrieval paths, the programme's real question is whether every meaningful action remains explainable after the fact. That pushes security teams toward provenance-rich telemetry, reviewable traces, and explicit baselines for what 'normal' agent behaviour looks like.

Model drift and workflow drift are converging: the same operational pattern can degrade either because the model changes or because the surrounding harness changes with it. Programmes that monitor only model quality will miss the broader governance failure, so agent lifecycle control has to include harness changes, retrieval logic, and permission scope together.

AI SOC maturity will be judged by governed delegation, not by how many tasks the system can automate: the practical test is whether an agent can be trusted to do less, with clearer boundaries, when the environment is noisy. That is the difference between useful assistance and unmanaged autonomy.

For practitioners

• Define bounded agent roles before production Separate hunting, validation, incident response, reporting, and telemetry-checking duties so each agent has a narrow purpose and minimal authority.
• Treat retrieval design as part of the control plane Use SQL, structured document traversal, and summarisation only where each one matches the investigation question and preserves evidential context.
• Freeze stable agent baselines and review deltas Save known-good versions, require human review for proposed changes, and compare new traces against a rolling baseline before release.
• Add trace review to operational governance Record tool use, sequence, and decision points so investigators can explain how the system reached a result and detect when behaviour changes.

Key takeaways

• MCP becomes useful in security operations only when the harness around it enforces bounded delegation, evidence capture, and reviewable behaviour.
• Dynamic retrieval and orchestrated multi-agent workflows can improve investigations, but they also move governance into the control plane rather than the user interface.
• Self-improving agents need version control and drift monitoring, because silent behavioural change is a governance failure even when the output still looks plausible.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Identity Maturity Model · Agentic AI Security Guide

Key terms

• MCP Agent Harness: A controlled wrapper that lets an AI model call tools, read context, and execute tasks inside a defined workflow. In practice, it is the orchestration layer that turns model output into bounded actions, with humans still responsible for scope, review, and accountability.
• AI Agent Drift: AI agent drift is when an agent diverges from the authorised plan it was supposed to follow. The agent may not be compromised or malicious, but its actions no longer match the intended workflow, which creates governance, compliance, and operational risk in production environments.
• Bounded Delegation: Bounded delegation is the practice of limiting how far authority can move from one identity to another, and under what conditions. For agentic systems, the boundary must cover tool choice, execution timing, and downstream hops, or accountability quickly becomes ambiguous.
• Dynamic Retrieval: Dynamic retrieval is the ability of a retrieval system to adjust its search strategy in response to the user’s query. Instead of following a fixed path, the system can skip retrieval, change granularity, try different sources, or refine the search based on what the first pass returns.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners who need to govern machine access paths. It is designed for teams that must connect identity controls to operational security decisions across modern systems.