MCP is becoming the backbone of agentic developer workflows

At a glance

What this is: This analysis says MCP is becoming the connective layer for agentic developer workflows, with security controls moving closer to code creation and tool invocation.

Why it matters: It matters because identity, trust, and authorization decisions are shifting into developer tooling, which changes how security teams govern AI-assisted software delivery.

By the numbers:

• Over 250 developers gathered to build 50+ projects at the AWS AI Agents Hackathon.

Context

Model Context Protocol, or MCP, is the interface layer that lets AI agents connect to tools, context, and development environments. In this article, Semgrep argues that MCP is becoming the backbone of agentic developer workflows because it makes security checks, model selection, and tool access part of the build process rather than a later review step.

The governance problem is not only code quality. It is the widening trust boundary around agent-assisted development, where developers increasingly invite models, extensions, and remote servers into environments that already contain credentials, source code, and release paths. That shifts security from traditional perimeter controls toward workflow-level authorisation and inspection.

Key questions

Q: What breaks when AI agents use MCP without stronger governance?

A: Governance breaks when the organisation assumes access happens through a stable, inspectable human workflow. MCP-connected agents can retrieve data and trigger tool calls across many systems in one session, so blind spots emerge in discovery, classification, and audit. If policy, logging, and inspection are not agent-aware, the organisation cannot prove what was accessed or why.

Q: Why do multi-LLM developer workflows increase the need for deterministic security checks?

A: Because model choice becomes fluid, security cannot rely on the behaviour of any one model or provider. Deterministic checks such as static analysis provide a stable control layer that can evaluate output quality and risk regardless of which LLM produced the code. That makes validation the constant, while models remain interchangeable inputs.

Q: What are the signs that browser-based AI coding is bypassing security controls?

A: Common signs include generated code moving from browser to repository without being scanned, security feedback appearing only after commit, and developer tools lacking integrated policy checks or inspection points. If the browser is where the code is created but not where it is governed, the organisation has a blind spot in its delivery chain.

Q: How should security teams decide whether to allow third-party MCP servers?

A: Treat them like privileged integrations rather than ordinary plugins. Teams should review what systems the server can reach, whether its code has been assessed, how access can be revoked, and what audit evidence will exist if the server is used in a consequential workflow.

Technical breakdown

Why MCP is becoming the control plane for agentic workflows

MCP standardises how AI agents request tools, context, and environment access, which turns it into a practical control plane for agentic development. In the hackathon example, the protocol allowed a security scanner to sit directly inside IDE workflows so generated code could be checked before it moved downstream. That matters because the agent is no longer only producing text. It is interacting with repositories, local tooling, and cloud-connected services in a structured session. The security value comes from placing deterministic controls next to probabilistic generation, not from the model itself.

Practical implication: treat MCP connections as governed access paths, not convenience integrations.

Why multi-LLM workflows change trust and validation

The article shows teams switching between Claude, GPT-4, and Llama depending on task, cost, privacy, or output quality. That multi-model pattern changes governance because no single model becomes the stable source of truth. Instead, security and quality checks need to validate outputs across models and compare them against deterministic criteria such as static analysis. This is especially relevant where an LLM can produce code that looks plausible but is insecure. The important technical shift is that the model becomes interchangeable, while the control point remains the validation layer around it.

Practical implication: validate model output with deterministic checks before it enters the codebase.

How browser-based AI coding creates security blind spots

Browser-native coding tools can compress development friction, but they often lack deep security integrations and MCP support. That creates a blind spot where code may be generated, edited, and copied into production paths without being scanned in the browser session. The article’s browser-extension example is notable because it brings scanning into the same environment where the code is created. The mechanism matters: if security only starts after the browser session ends, then the riskiest content has already crossed the trust boundary. In other words, the browser becomes part of the development control surface.

Practical implication: extend security scanning into browser-based coding environments before code is exported.

Breaches seen in the wild

• postmark-mcp malicious MCP server 2025: A fake Postmark MCP server on npm quietly BCC'd every email AI agents sent through it to an attacker, using victims' own Postmark tokens.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP is turning developer tooling into an identity and authorisation problem, not just an integration problem. Once agents can invoke tools, pull context, and interact with environments through a standard protocol, security teams have to govern who or what is allowed to act inside the workflow. That makes the access boundary the control point, not the model selection. Practitioners should evaluate MCP as a delegated-access layer that needs explicit policy, auditability, and revocation paths.

Multi-LLM development reduces model dependency but increases the burden on validation. If teams can swap models for privacy, cost, or output quality, then security assurance cannot depend on one provider or one model behaviour pattern. The control plane moves to the checks around the model, especially deterministic analysis that can judge whether generated code is safe enough to proceed. Security teams should focus on the reliability of the validation layer, not the personality of the model.

Browser-based AI development exposes a workflow gap that conventional AppSec controls do not close. The article shows that convenience-first tools can leave generated code unscanned until too late in the path. That creates a governance gap between generation and review, where the most productive developer environments are also the least instrumented. The implication for practitioners is that the browser is now a security-relevant runtime, not a neutral editor.

Malicious MCP servers make trust a pre-flight decision, not an after-the-fact discovery. Semgrep’s example reflects a broader pattern: developers are connecting external tools into agent workflows before the ecosystem has mature vetting norms. That means the question is no longer whether a server exists, but whether its codebase, hosting posture, and exposed behaviours are acceptable before the first remote call. Security teams should treat third-party tool admission as a governed risk decision.

Identity governance for agentic development needs to account for tool-bearing software, not only human developers. The most important shift here is that the workflow itself is becoming an actor with delegated access to code, tokens, and services. This pushes IAM, PAM, and secure development governance into the same conversation. Practitioners should design controls around the delegated actions performed in the workflow, because that is where exposure now accumulates.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Agentic development will keep pushing governance closer to the editor, because the trust decision now happens before code ever reaches a pipeline. Security teams should assume that the workflow itself is an access-bearing actor and design controls accordingly.

Workflow-level authorisation: The important shift is not just scanning faster. It is deciding which tools an agentic workflow can touch, which context it can see, and which external servers it may invoke before those actions are allowed.

69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That is the right direction of travel, because identity controls that assume static human-paced workflows will lag behind agent-timed development.

For practitioners

• Govern MCP server admission Require a formal review before any MCP server is connected to an agentic development environment. Check the server's codebase, hosting posture, and exposed tool actions before remote calls are allowed.
• Embed deterministic code scanning in the editor Run static analysis inside the IDE or browser session so generated code is checked before it is copied, committed, or deployed. Do not wait for downstream pipelines to catch unsafe output.
• Separate model choice from security approval Allow developers to switch between LLMs for task fit, but keep security approval, policy checks, and release gating independent of model selection.
• Treat browser-based coding as a governed control surface Instrument browser coding tools with the same scanning and policy checks you would expect in a local IDE, because the browser session can now create production-bound code.

Key takeaways

• MCP is emerging as the connective tissue for agentic development, which moves trust, access, and inspection decisions into the developer workflow itself.
• Security gaps now show up when models, browser tools, and third-party servers are allowed to act before deterministic checks run.
• Teams that want safe AI-assisted development need to govern tool admission, output validation, and browser-session security as one control plane.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Deterministic Security: Deterministic security uses fixed rules, repeatable logic, and consistent validation to decide whether a finding is real. In AppSec, it provides the trusted baseline that AI-assisted analysis can enrich, but not replace, when teams need stable, auditable results.
• Public MCP Server: A public MCP server is a Model Context Protocol endpoint exposed for external AI agents or applications to discover and use tools, data, or actions. It publishes a standardized interface for model-to-system interaction, so access control, authentication, logging, and input validation become critical security requirements.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.