MCP security exposes the limits of agentic AI governance

At a glance

What this is: This is an analysis of why MCP security has become a governance problem for agentic AI, with the core finding that runtime behavior undermines static identity, audit, and authorization assumptions.

Why it matters: IAM, IGA, and security architects need to understand where existing NHI and access control patterns stop working once AI agents can chain tools, ingest external inputs, and act at runtime.

Context

MCP security is the governance gap exposed when agentic AI systems can make decisions from runtime inputs rather than fixed code paths. That changes the identity problem because the control surface now includes prompts, tools, connected data sources, and the policies that govern them.

For identity teams, the important shift is that static approval models no longer describe the real attack surface. If the agent can alter what it sees, call more tools, or inherit broader permissions than intended, then identity, audit, and authorization controls must be evaluated as runtime controls, not only deployment controls.

Obot frames RSAC 2026 as the moment practitioners stopped asking whether agentic AI creates risk and started asking what governance can still be trusted when the model sits inside operational decision-making.

Key questions

Q: What breaks when MCP security is treated as a single control layer?

A: Teams overestimate runtime coverage and miss the risks that sit above it. That usually leads to weak assumptions about intent validation, context leakage, and shadow endpoints, while the real control gaps remain unowned across identity, platform, and agent operations.

Q: Why do MCP-based agents create more risk than ordinary API integrations?

A: Because the agent is choosing actions, chaining tools, and preserving context across steps. Ordinary API controls assume predictable request patterns, while MCP can turn one legitimate session into a route for data exposure or privilege escalation. The risk increases when identity, context, and tool access are not governed together.

Q: What are the signs that MCP governance is failing?

A: Common signs include agents reaching systems outside their intended workflow, incomplete audit trails for tool use, and data retrieval that cannot be tied back to a clear business purpose. If teams cannot reconstruct who invoked which tool, against which resource, and why, the MCP layer is already operating with insufficient control.

Q: How should organisations govern agentic AI in observability workflows?

A: Treat AI as a bounded operator, not an all-purpose controller. Give it narrow permissions, require audit trails, and restrict it to approved actions such as validation, suggestion, or rollback of pre-defined changes. If the telemetry path is fragmented, fix that first, because agentic automation amplifies whatever control model already exists.

Technical breakdown

Why MCP security breaks static trust models

Model Context Protocol connects LLMs and AI agents to tools and data sources, which means the agent's behavior is not just a function of code but of whatever it reads at runtime. That breaks three assumptions common in traditional security models: that the actor is known in advance, that the action sequence is fixed, and that the audit trail can be reconstructed from deterministic execution. In MCP deployments, prompts, tool responses, and connected systems all become part of the security boundary. The protocol itself does not enforce security, so controls have to be layered around it rather than assumed inside it.

Practical implication: Treat MCP as an integration layer that requires external identity, authorization, and logging controls at runtime.

How MCP gateways change identity and authorization

An MCP gateway sits between the agent and the tools, centralizing authentication, policy checks, and audit logging. Technically, that shifts control from distributed tool owners to a governed inspection point that can constrain tool invocation, mediate access to resources, and preserve evidence of what the agent requested and received. It also reduces reliance on direct secrets in the agent itself, which matters because static credentials create a larger blast radius when the agent can chain actions autonomously. The gateway does not solve model behavior, but it does create an enforceable boundary for access and traceability.

Practical implication: Route agent tool calls through a central gateway so permissions and logs are consistent across the estate.

Why supply chain risk now reaches the agent layer

MCP ecosystems include server packages, skills, registries, and third-party connectors, all of which can introduce malicious instructions or compromised code. That makes supply chain risk more than dependency hygiene. A malicious server or poisoned skill can influence tool descriptions, parameters, or the data returned to the model, which in turn changes how the agent behaves without altering the model itself. In practice, the compromise path often enters through trusted integration components rather than through the agent runtime directly. That is why runtime protection and registry governance matter as much as model-level safeguards.

Practical implication: Inventory MCP components and restrict unvetted servers, skills, and connectors before they reach production agents.

Threat narrative

Attacker objective: The attacker aims to steer trusted agent workflows into data exposure, unauthorized tool use, or control-plane abuse while appearing to operate inside approved infrastructure.

1. Entry occurs through the agent ecosystem, where a malicious MCP server, poisoned skill, or compromised tool package is introduced into a trusted workflow.
2. Credential or policy abuse follows when the agent accepts runtime inputs or tool metadata that expand what it can query, invoke, or delegate.
3. Impact occurs when the agent uses those altered instructions to reach connected systems, expose sensitive data, or execute unauthorized actions through legitimate channels.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP security is exposing a governance model built for deterministic software, not adaptive systems. The core failure is not just missing tooling, but the assumption that security can be validated once and then trusted at runtime. When the agent's decisions depend on live inputs, every static control becomes provisional, and identity teams have to treat runtime inspection as a first-class control plane.

Runtime data has become the real security boundary for agentic AI. That is a broader shift than prompt injection alone. If prompts, tool responses, and connected data sources can all alter behavior, then least privilege is no longer only about who the actor is, but also about what the actor is allowed to see and combine in-session. Practitioners should read this as a signal that authorization must follow the execution path, not just the identity record.

Centralized MCP governance is becoming the practical minimum for auditability. Distributed logging and team-by-team tool controls leave no reliable evidence trail when agents span multiple services. A governed control plane matters because accountability in agentic systems depends on preserving the sequence of requests, responses, and policy decisions, not merely on recording a successful action after the fact.

Tool and skill supply chains now sit inside the trust boundary of AI operations. That makes registry governance, connector hygiene, and runtime monitoring part of identity security rather than adjacent hygiene work. The practitioner implication is straightforward: if the environment cannot inventory and constrain agent inputs, it cannot credibly govern the agent itself.

Runtime governance gap: Agentic AI systems fail when security is applied only at build or deployment time. The assumption that approved code implies approved behavior breaks once the model can interpret new inputs and chain actions dynamically. Teams should respond by rethinking where governance lives, because the decisive control point is now the execution layer.

From our research library:

• Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
• Read next: Agentic AI Security Guide

What this signals

Agentic AI governance is moving from policy discussion to control-plane design. Teams that still treat agents as extensions of human sessions will miss the point, because the governance problem is now about what the system can decide, combine, and invoke at runtime.

Runtime governance gap: access review cadences assume privileges persist long enough to be reviewed, but agentic systems can acquire context, call tools, and complete work inside a narrow execution window. That shifts the control emphasis toward issuance-time policy, central logging, and constrained tool access.

The 2026 Infrastructure Identity Survey found that only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey. That gap suggests the market is adopting faster than its governance model can absorb.

For practitioners

• Centralize MCP enforcement Route agent tool calls through a single control point that can authenticate, authorize, and log every request before it reaches external systems.
• Inventory agent inputs and connectors Map every MCP server, skill, registry, and external data source that can influence an agent's runtime decisions, then remove anything you cannot govern.
• Replace static trust with runtime policy Scope permissions to the minimum tool set and data set needed for the task, then enforce policy at the moment of invocation rather than only at provisioning.
• Make audit trails investigation-ready Capture the full sequence of prompts, tool calls, policy decisions, and returned data so incident response can reconstruct what the agent touched and why.
• Harden the agent supply chain Approve MCP servers and skills through the same scrutiny you would apply to third-party access, including source review, provenance checks, and change monitoring.

Key takeaways

• MCP security is best understood as a runtime governance problem because agentic systems behave according to live inputs, not fixed code alone.
• Centralized enforcement and auditable tool mediation are the controls that change the risk profile, especially when agents interact with third-party servers and skills.
• Without inventory, policy enforcement, and investigation-ready logs, organisations cannot credibly govern agentic AI or explain what an agent actually did.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Tool chaining: Tool chaining is the practice of using one capability to unlock the next, such as searching for a secret, authenticating with it, and then using that access to reach another system. For AI agents, tool chaining is the mechanism that turns broad permissions into compound risk.
• Agent Supply Chain: The collection of models, tools, plugins, MCP servers, prompt libraries, and dependencies that make an agent function. It matters because compromise or misconfiguration in any linked component can alter agent behaviour and expand attack surface.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.