TL;DR: The new MCP Registry and ChatGPT support for MCP could accelerate server discovery and adoption, but Obot’s discussion shows that uncurated publication, weak validation, and shadow MCP growth leave enterprises with a governance problem, not just an integration opportunity. The trust model now depends on downstream controls that can curate, verify, and govern MCP exposure.
At a glance
What this is: This is an analysis of the MCP Registry preview and ChatGPT support for MCP, showing that open server publication can accelerate discovery while expanding governance, trust and shadow usage risks.
Why it matters: It matters because IAM, PAM and NHI teams will need to govern how MCP servers are discovered, authenticated, curated and exposed to users and agents across enterprise environments.
Context
MCP registry governance is emerging as a control problem, not just a discovery problem. A registry that allows broad publication can speed adoption, but it also creates a new trust boundary around who can publish, who can consume, and which servers are actually safe to expose inside the enterprise.
For identity and access teams, the practical question is how a public discovery layer connects to private governance. Once MCP servers become easy to find and use, enterprises need controls for provenance, access, visibility and lifecycle management across both human users and AI-driven workflows.
Obot's discussion frames the issue as a downstream governance challenge: the registry can list servers, but the enterprise must decide which of them are trusted, authenticated and operationally acceptable. That is typical of early platform growth, where demand outruns control design.
Key questions
Q: What breaks when MCP servers are published without enterprise curation?
A: Discovery becomes faster than governance. Public publication can expand the available server pool, but without curation the enterprise loses a clear approval boundary, and employees may connect to unverified servers that have not been assessed for provenance, access scope or compliance. That turns adoption into a shadow inventory problem.
Q: Why do uncurated MCP registries create security risk?
A: They separate visibility from trust. A server can be discoverable without being operationally acceptable, so security teams need downstream controls to decide which servers are authorised, how they are documented, and which identity checks must happen before use. Otherwise, convenience becomes the control plane.
Q: How should enterprises govern MCP discovery and access?
A: Treat discovery, approval and connection as separate governance steps. The registry can provide discovery, but enterprises should enforce curation, identity-tied access, logging and ownership before a server reaches users or agents. That keeps the catalog aligned to existing IAM and NHI governance rather than bypassing it.
Q: What is the difference between an open MCP registry and a curated one?
A: An open registry maximises publication and findability, while a curated registry filters servers through organisational policy, ownership checks and risk review. The open model is useful for ecosystem growth, but the curated model is what makes enterprise consumption defensible because it adds accountability and visibility.
Technical breakdown
How MCP registry discovery changes the trust boundary
A registry is a discovery plane, not a security guarantee. In this model, anyone can publish an MCP server and minimal checks such as DNS or repository ownership only establish basic authenticity, not operational safety. That means the trust boundary moves from the protocol itself to the enterprise's downstream controls for curation, approval and exposure. For IAM and NHI teams, the important shift is that discovery becomes open while trust remains local. The registry can tell clients what exists, but it cannot decide what is fit for production use.
Practical implication: treat registry membership as an input to review, not as an approval signal.
Why curated downstream registries matter for enterprise control
The article describes a two-layer model: an open upstream registry and curated downstream registries operated by organisations, vendors or platforms. This matters because the downstream layer becomes the control point for policy enforcement, documentation, access control and governance. In practice, a curated catalog can separate what is merely published from what is actually sanctioned for internal use. That is especially relevant for organisations that need to align MCP usage with identity platforms, visibility requirements and compliance expectations.
Practical implication: build a sanctioned MCP catalog that sits between public discovery and employee consumption.
Why ChatGPT support raises the stakes for MCP consumption
Embedding MCP support into a major AI client changes the consumption side of the equation. Once users can connect directly from a popular AI interface, shadow MCP growth becomes easier because discovery and usage collapse into a single workflow. That increases the chance of unverified servers entering enterprise use through convenience rather than formal onboarding. The governance issue is not only server publication, but also how clients broker access, surface provenance and keep usage observable across agents and humans alike.
Practical implication: extend access governance to client-side discovery and connection paths, not just server onboarding.
Breaches seen in the wild
- Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
- McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Open MCP publication creates a governance layer that enterprises do not yet control: the registry can standardise discovery, but it does not standardise trust. Minimal validation can help scale participation, yet it leaves organisations responsible for the harder question of what should be allowed into production use. The implication is that discovery and approval are no longer the same decision.
Curated downstream registries are the real control plane: the registry preview matters because it shifts enterprises toward building their own sanctioned catalogs. That is where provenance, identity integration, documentation and usage rules become enforceable. Enterprises that skip this layer will end up with a directory problem that quickly becomes an access problem.
MCP consumption is becoming an identity governance issue, not just an integration issue: once users and agents can browse and connect to servers easily, access scope, approval and visibility all need to be tied back to identity controls. This is a familiar pattern in NHI governance, where broad discoverability without lifecycle control produces shadow usage.
Shadow MCP discovery: the combination of public publication and client-side integration creates a new exposure pattern where services can be found and used faster than they can be governed. That is not an MCP flaw alone; it is a control design gap between open ecosystems and enterprise enforcement. Practitioners should treat this as an identity and inventory problem from day one.
The market is moving toward governed exposure, not pure openness: the preview points to an ecosystem where value comes from the ability to curate, verify and broker MCP access at enterprise scale. That trajectory rewards organisations that can connect discovery, identity and policy into one operating model. The practical takeaway is to assess whether your current controls can sanction what your users can now find instantly.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- Read next: MCP Security Guide
What this signals
MCP registry discovery is creating an identity control gap: when publication is open and validation is lightweight, enterprises inherit the job of separating findability from trust. That pushes MCP governance into the same operating model as other NHI catalog problems, where discovery without ownership quickly becomes exposure.
The new control question is not whether MCP servers exist, but which ones are sanctioned for use and how that sanction is enforced across clients, users and AI workflows. Without a curated catalog, organisations will struggle to distinguish legitimate adoption from shadow consumption.
Developer behaviour also matters. Only 44% of developers are reported to follow security best practices for secrets management, according to the State of Secrets in AppSec, which suggests that open MCP ecosystems may amplify familiar hygiene gaps rather than introduce entirely new ones.
For practitioners
- Define a sanctioned MCP catalog Establish a downstream registry that only exposes servers that have passed enterprise review, documentation and ownership checks.
- Tie MCP access to identity controls Require authentication and authorisation to flow through existing identity platforms before users or agents can connect to a server.
- Review client-side discovery paths Assess where employees can browse, search or connect to MCP servers from AI clients and close ungoverned access paths.
- Track MCP usage and provenance Log which servers are used, who approved them and which internal teams own them so governance can keep pace with adoption.
- Create onboarding criteria for public servers Set minimum requirements for authenticity, documentation and business approval before any public MCP server enters the enterprise catalog.
Key takeaways
- Open MCP publication improves discovery but shifts the hardest problem to enterprise trust and governance.
- The registry preview and ChatGPT support together create a faster path from discovery to consumption, which can amplify shadow usage.
- Enterprises need curated catalogs, identity-tied access and usage visibility before MCP adoption scales further.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Public MCP servers act like third-party NHIs that need provenance and trust checks. |
| NHI-10 — Human Use of NHI | Employees browsing and connecting to MCP servers turn human behaviour into an NHI exposure path. | |
| Recommendation — Assess public MCP servers under NHI-03 before allowing them into any enterprise catalog. Apply NHI-10 to stop users from connecting to ungoverned MCP servers outside sanctioned workflows. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI clients and agents can amplify privilege misuse when server access is not governed. |
| Recommendation — Use ASI03 to bind agent access to approved MCP servers and review privilege scope before use. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on who may access which MCP servers and under what authorization. |
| Recommendation — Apply PR.AA-05 to enforce authorization boundaries for MCP discovery and connection. | ||
| MITRE ATT&CK | TA0006;TA0007 — Credential Access; Discovery | Uncurated server growth and client-side discovery can expose credential paths and expand attacker visibility. |
| Recommendation — Map MCP exposure to TA0006 and TA0007 to prioritise discovery and credential hygiene controls. | ||
Key terms
- Mcp Registry: An MCP Registry is a catalog that lists available Model Context Protocol servers, tools, and resources for AI agents to discover and use. It typically stores metadata such as endpoints, capabilities, ownership, and trust information, helping organizations govern which tools agents can access and how those connections are managed.
- Curated Registry: A curated registry is a governed catalog of approved tools or services with verified configurations and ownership. In NHI and AI tooling programmes, it functions as the control point for sanctioned discovery, installation, and lifecycle management.
- Shadow MCP: Shadow MCP is an unauthorized or ungoverned use of the Model Context Protocol inside an organization. It appears when AI agents, scripts, or tools connect to data or actions through MCP servers without security review, inventory, policy control, or monitoring. This creates hidden access paths, data exposure, and weak accountability.
- Downstream Control Plane: A downstream control plane is the enterprise layer that decides what discovered services are actually usable under policy. For MCP, it bridges public availability and internal governance by enforcing access control, observability and lifecycle oversight.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org