MCP tool call security is exposing gaps in agent data governance

At a glance

What this is: Nightfall argues that MCP turns agent data movement into a governance problem because tool calls, arguments, and responses can move sensitive information through paths legacy controls often do not interpret.

Why it matters: This matters to IAM and NHI practitioners because agent approvals, tool permissions, and data controls must be aligned around machine-speed workflows, not only human-mediated access.

Context

MCP standardises how AI applications connect to tools and data sources, but standardisation does not remove control gaps. When local stdio and remote HTTP transports carry tool calls, arguments, and responses, legacy endpoint, application, identity, and network controls can lose the semantic context needed to judge whether data movement is legitimate.

The governance issue is not only visibility. It is whether security teams can inspect and intervene on agentic data movement before a tool invocation, delegated action, or shell command crosses an approved boundary. In that sense, MCP sits at the intersection of data security, access control, and NHI governance rather than as a pure integration protocol.

The article focuses on a problem that is already typical in agentic environments: agents and copilots are increasingly allowed to touch sensitive data without controls designed for autonomous, machine-speed activity.

Key questions

Q: What breaks when MCP tool calls are not inspected like normal data flows?

A: Security teams lose visibility into the actual context of agent actions, including tool arguments, responses, and delegated steps. That means sensitive data can move through an apparently approved workflow without the control plane recognising the risk. The result is not just missed alerts, but failed containment when machine-speed actions cross approved boundaries.

Q: Why do MCP-based agents create more risk than ordinary API integrations?

A: Because the agent is choosing actions, chaining tools, and preserving context across steps. Ordinary API controls assume predictable request patterns, while MCP can turn one legitimate session into a route for data exposure or privilege escalation. The risk increases when identity, context, and tool access are not governed together.

Q: What are the signs that agent data controls are failing on MCP workflows?

A: The clearest signs are unreviewed tool calls, excessive exceptions, repeated false positives, and sensitive content appearing in outputs that were never meant to leave the source system. If security teams can see the event but not reliably block it, the governance model is observational rather than enforceable.

Q: Should organisations treat MCP tool governance differently from standard API governance?

A: Yes. APIs usually expose structured services, while MCP combines tool discovery, contextual prompts, delegated action, and response handling into one agentic workflow. That means governance must cover authorisation, data inspection, and execution context together, not as separate controls that can drift out of sync.

Technical breakdown

MCP tool call semantics and why legacy controls miss them

Model Context Protocol does not just move bytes. It wraps tool discovery, tool invocation, arguments, responses, and session context into a workflow that can be executed by an agent rather than a person. That matters because legacy DLP and network monitoring often classify files or packets, not the meaning of a tool call. When the agent asks a database, API, or local tool for data, the security question is whether that request was authorised, in scope, and safe to execute. Without semantic inspection, the control plane sees activity but not intent or delegation.

Practical implication: Inspect tool-level context, not only files or packets, before allowing agent-driven data movement.

Why local stdio creates an inspection gap

Local stdio is a host-to-process channel, so traffic can move inside the endpoint without traversing a network control that would normally see and filter it. That makes it useful for low-latency agent workflows, but difficult for network-only security tools to reconstruct. The result is an asymmetric control problem: the agent can read data from a local source, invoke a tool, and pass outputs along a chain that never leaves the device in a form a perimeter control can understand. Endpoint and application-layer controls may still observe activity, but only if they are designed for agentic context.

Practical implication: Extend policy enforcement to the endpoint and application layer where local agent traffic is created.

What real-time enforcement changes for MCP governance

Monitoring alone leaves a timing problem. By the time logs are reviewed, an agent may already have queried a database, forwarded a secret, or written sensitive output into another system. Real-time control changes the governance model by blocking, redacting, quarantining, or approving sensitive movement before completion. That is the difference between retrospective visibility and preventive control. For MCP, this is especially important because tool calls can be repeated at machine speed, and one approval path may be reused across many downstream actions.

Practical implication: Apply inline enforcement to high-risk MCP tool calls instead of relying on after-the-fact review.

Threat narrative

Attacker objective: The objective is to exfiltrate sensitive data or secrets through authorised-looking agent workflows that bypass traditional inspection and enforcement boundaries.

1. Entry occurs when an agent or copilot gains access to an MCP-enabled workflow that can invoke tools and data sources without human intervention.
2. Credential or data access follows when the agent queries a database, API, or local resource and receives sensitive content through tool arguments or responses.
3. Impact occurs when sensitive data leaves approved boundaries through repeated machine-speed calls that legacy controls do not reconstruct in time.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP tool-call security is really an identity and data-governance problem, not just an integration problem. The article shows that agents can move data through authenticated tool chains that still sit outside legacy inspection logic. That means the control question is who or what is authorised to invoke a tool, what data that invocation may touch, and whether the resulting movement is observable before it exits the approved boundary. Practitioners should treat MCP as governed access, not merely transport.

Local stdio is the named governance blind spot because it shifts sensitive movement onto the host. Network controls were never designed to interpret host-local tool exchanges, and that limitation becomes material once an agent can query, transform, and forward data without leaving the endpoint in a network-visible form. The right response is to move inspection closer to execution, where the tool call, context, and content are still visible to the control point. Practitioners should map where their current controls lose semantic context.

Agentic data boundary drift: this article exposes the tendency for data controls to lag behind autonomous workflows that cross systems faster than policy teams can model them. The governance failure is not absence of a DLP logo but the mismatch between human-era control design and machine-speed execution. In practice, organisations need one policy model that can reason across human users, agents, endpoints, and SaaS without fragmenting enforcement. Practitioners should eliminate duplicate policy domains that cannot share context.

Detection precision now matters as a governance control, not just an operational convenience. When false positives are high, teams either mute alerts or create exception paths that weaken enforcement over time. The article's emphasis on precision and real-time blocking shows that MCP security succeeds only when the control is accurate enough to stay on. Practitioners should benchmark detection quality alongside coverage and response speed.

The market is moving toward unified control planes for humans and agents. This is the clearest signal in the article's framing of one detection brain across multiple surfaces. For identity leaders, that validates a shift away from separate policies for people, bots, and AI systems. Practitioners should expect future governance to converge around shared context, shared attribution, and shared enforcement rather than separate point controls.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: MCP Security Guide

What this signals

MCP tool-call governance will increasingly be judged by whether controls can interpret execution context, not merely whether they can see traffic. As more agent workflows move inside endpoints and across local transports, the control boundary has to shift from perimeter visibility to decision-time inspection. Practitioners should assume that the next governance failure will come from context loss rather than total invisibility.

The control gap is now a policy-design problem as much as a telemetry problem. Teams that keep separate rule sets for SaaS DLP, endpoint DLP, and AI governance will keep rediscovering the same exception paths. NHI and agent security programmes need one decision model for humans and machines so that approvals, redactions, and blocks stay consistent across surfaces.

For practitioners

• Map MCP tool paths to the data they can touch Inventory every MCP-enabled workflow, then classify which tool calls can reach secrets, PII, source code, or regulated records. Prioritise workflows where local stdio or remote tool access can move data without a human approval step.
• Block or redact risky tool outputs inline Use preventive controls for tool responses that can carry secrets or sensitive records, especially where monitoring would only show the event after data has already moved.
• Separate read-only tools from destructive actions Apply stricter approval and policy checks to MCP tools that can write, delete, or trigger downstream changes, and do not treat them as equivalent to read-only query paths.
• Extend governance to local endpoint execution Treat endpoint-hosted agent sessions as first-class control points because local stdio and coding-agent workflows may bypass network inspection entirely.
• Measure false positives before scaling enforcement Test detection precision on real agent traffic so that the policy engine can stay inline without forcing teams into exception-heavy workflows.

Key takeaways

• MCP makes agent data movement a governance issue because tool calls can carry sensitive content through contexts that older controls do not interpret well.
• The exposure is not only visibility loss. The larger problem is that machine-speed workflows can cross an approved boundary before a human review ever occurs.
• Inline inspection and policy enforcement are the controls that change MCP from an observability problem into an enforceable security boundary.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Agentic Data Flow: Agentic data flow is the movement of information through AI systems that can process, route, or redistribute content with broad permissions. It creates a governance challenge because access decisions and data movement can occur without a human triggering every step, which requires identity-aware and runtime controls.
• Local Stdio: A local standard input and output channel used by some AI applications to communicate with MCP servers without sending traffic through a traditional network path. It creates a visibility challenge because perimeter tools may not see the interaction at all.
• Tool Call Context: The combined metadata around an agent request, including the tool name, arguments, response, and surrounding session state. This context is what turns raw activity into something governable, because controls need to understand why data was accessed, not just that it moved.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps practitioners align identity controls with the governance realities of autonomous workflows.