Orca’s MCP tools show where agent output hits the interface limit

At a glance

What this is: This is an Orca Security analysis of why MCP-driven agent output is hitting the limits of chat-first interfaces, especially when investigations become long, structured, and action-oriented.

Why it matters: For IAM and security teams, the issue is not only what an agent can retrieve but whether practitioners can review, share, and act on that output without losing context or control.

Context

MCP tool output is the machine-readable answer that an AI agent returns after calling connected tools and data sources. In this article, the problem is not that the agent lacks depth, but that the interface used to present that depth cannot keep pace with the work.

Orca Security argues that security teams are now receiving full investigations through MCP tools, including asset context, attack paths, blast radius, compliance impact, and remediation steps. When the result set grows into a large narrative or workflow artifact, chat becomes a weak container for operational decision-making.

The underlying governance question is simple: if the analyst cannot consume the output cleanly, the value of the agent drops even when the underlying detection or investigation is sound. That is typical of real security operations, not an edge case.

Key questions

Q: How should security teams decide when MCP output should stay in chat versus move to a richer interface?

A: Use chat for short, self-contained answers and move to richer interfaces when the result includes multiple evidence points, ranked findings, or follow-up actions. If the analyst must scroll, cross-reference, or reconstruct priority, the output has outgrown chat. The right container is the one that lets the practitioner understand and act without losing context.

Q: Why do long MCP tool responses become a problem for security operations?

A: Long responses create cognitive overload, because the analyst has to extract priority, severity, and next steps from dense text instead of receiving a structured view. That slows triage and increases the chance that important details are missed. The issue is not the quality of the answer, but the effort required to use it.

Q: What breaks when agent findings cannot be shared cleanly across teams?

A: The handoff breaks. If the output cannot be reused in tickets, reviews, or incident coordination, teams must re-create the investigation context manually, which adds delay and inconsistency. A useful agent output is not only accurate, it is portable enough to support downstream work without being rewritten.

Q: How can security teams spot unsafe MCP workflow designs?

A: Look for any path where public or low-trust input can reach a local tool that has file, command, or operating-system privileges. The clearest warning sign is a workflow that can cross from external data into host action without a mandatory human checkpoint or a separate trust zone.

Technical breakdown

Why MCP tool output outgrows chat UIs

MCP, or Model Context Protocol, lets an agent call tools and return structured results from connected systems. In security workflows, that often means the model is not just answering a question but assembling a mini investigation with correlated evidence, impact assessment, and recommended next steps. The technical problem appears when the presentation layer assumes a chat answer should stay brief, linear, and human-scannable. Once the payload becomes long-form Markdown or multi-step evidence, the interface adds cognitive load instead of reducing it.

Practical implication: design the presentation layer for investigation-sized results, not only conversational replies.

How visual and HTML outputs change security triage

A visual summary turns the agent’s findings into ranked, spatially organised information that a practitioner can understand faster than a dense paragraph. HTML extends that value by turning the output into a persistent artifact that can be shared, referenced in tickets, and revisited outside the chat session. The point is not decoration. It is preservation of structure, severity, and sequence when the work has to move from analysis to coordination.

Practical implication: use shareable, structured outputs when findings need to travel beyond the original conversation.

What interactive MCP apps change operationally

MCP Apps extend the protocol so a server can return a live interface inside the conversation, not a static copy of one. That changes the workflow from read-only analysis to direct action, because the same card can show status, expose follow-on questions, and trigger the next step without tab switching. The architecture keeps context in the thread while also preserving a familiar console-like mental model for analysts who already know how to triage alerts.

Practical implication: prioritise interactive interfaces when the same workflow must support review, follow-up, and action in one place.

Breaches seen in the wild

• Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Interface design is becoming an identity governance control plane issue, not a presentation detail. When an MCP-connected agent returns the full investigative path, the real constraint is whether a human can still validate, prioritise, and act on the result before context degrades. That makes the output format part of the security workflow, not a cosmetic layer. Teams should treat readability and actionability as operational controls, not UX preferences.

Ephemeral investigation output creates a new form of decision latency. The agent may already have done the hard work, but if the result arrives as a wall of text, the analyst now has to reconstruct priority, impact, and next action manually. That does not just slow response. It shifts the bottleneck from machine analysis to human interpretation, which weakens the overall security loop.

Context-preserving interfaces will matter more as agentic security matures. Security teams do not only need answers from agents, they need answers that can survive handoff into tickets, incident channels, and team review. The stronger the workflow artifact, the less likely critical findings are to be lost between discovery and action.

Named concept: investigation-container mismatch. The article shows that the answer size can exceed the container the organisation uses to consume it. That mismatch is already visible in security operations and will intensify as agents return richer, more complete evidence sets. Practitioners should expect interface design to become part of their control architecture.

Agent output quality and operator usability are converging concerns. A security agent that produces excellent findings but cannot package them for human review still leaves the programme exposed to delay and misprioritisation. The mature operating model is one where retrieval, presentation, and action are designed as a single chain.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: MCP Security Guide

What this signals

Investigation-container mismatch: security teams are already seeing the point where answer depth exceeds the usefulness of a plain chat transcript. That pushes interface design into the governance conversation, because the way output is packaged now affects whether findings can be reviewed, escalated, or acted on without delay.

MCP-native workflows will increasingly need a split model: concise text for simple answers, structured artifacts for shared analysis, and live interfaces for action. That is less about presentation polish than about reducing the distance between detection and decision.

For practitioners

• Map agent output to consumption path Classify which findings stay in chat, which become HTML artifacts, and which require an interactive card so output size matches operational use.
• Preserve investigation context across handoffs Make sure the same alert, asset, and attack-path context survives transfer into tickets, chat rooms, and incident workflows without re-parsing the original prompt.
• Use visual summaries for triage ranking Prefer rendered views when the analyst needs to see which failing control or attack path deserves attention first, rather than infer priority from a long narrative.
• Separate read-only reporting from action interfaces Keep shareable reports for coordination, but reserve interactive interfaces for cases where the practitioner must trigger the next step from the same view.

Key takeaways

• Agentic security workflows are running into a presentation problem as much as an analysis problem, because the output can be richer than the chat interface that carries it.
• When security findings arrive as long-form investigations, teams spend more time reading and re-parsing them, which slows triage and raises operational friction.
• The practical answer is to match output format to task, using chat for brief answers, HTML for shareable artifacts, and interactive interfaces for response.

Key terms

• MCP-connected output: Data or results produced by an agent and exposed through the Model Context Protocol to another system, workflow, or AI consumer. This creates an external egress path that must be governed like any other access channel because sensitive data can leave the source platform through it.
• Interactive Interface: A live, action-capable view embedded in or alongside the conversation. It lets a practitioner inspect findings, trigger next steps, and keep context intact, which matters when the output is too rich for plain chat to carry safely.
• Investigation Artifacts: Investigation artifacts are the recorded outputs of a security case, including evidence, chronology, analyst reasoning, and final disposition. They are valuable because they persist after the alert is closed and allow later reviewers to reconstruct what happened without relying on tribal knowledge.
• Context Preservation: Context preservation is the practice of carrying identity-like attributes such as hostnames, device IDs, cloud tags, and service labels through every processing stage. It ensures events remain attributable and searchable across tools, which is essential for correlation, filtering, and investigation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.