Topic starter
06/06/2026 11:05 am
TL;DR: Agentic supply chain attacks now target runtime tool trust, with the article citing nearly 2,000 official MCP Registry entries, over 16,000 unofficial servers, and roughly 30 CVEs filed in two months as the ecosystem outpaced its security controls, according to WorkOS. Tool identity, manifest drift, and hosted-server isolation now sit inside the identity problem, not beside it.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “Securing agentic apps: How to vet the tools your AI agents depend on”.
By the numbers:
- The official MCP Registry launched in September 2025 and reached nearly 2,000 entries within months, while unofficial registries index over 16,000 servers.
- Between January and February of 2026, security researchers filed roughly 30 CVEs against MCP servers, clients, and infrastructure.
- A hosting platform flaw could have exposed credentials for over 3,000 hosted MCP servers.
Key questions
Q: What breaks when AI agents trust MCP tools after a single approval?
A: A one-time approval model fails when the tool can change after trust is granted.
Q: Why do agentic supply chain issues create security risk even when the code looks legitimate?
A: Because the attack surface includes semantics, hosting, and dependency paths, not only source code.
Q: How should security teams detect tool description poisoning in agentic systems?
A: Look for description text that reads like instructions, not capability statements, and compare every new description against a baseline.
Practitioner guidance
- Pin and re-approve every MCP manifest Capture the initial tool manifest as a baseline, compare every subsequent manifest against it, and block any tool addition, schema change, or description change until it is reviewed.
- Require authenticated server connections Make OAuth 2.1 authentication mandatory for remote MCP servers, and deny any server that cannot present a verifiable identity before the agent connects.
- Sandbox third-party servers Run hosted or external MCP servers with restricted outbound network access, limited filesystem exposure, and no inherited host credentials.
Bottom line: Agentic supply chain attacks shift security attention from build-time dependencies to runtime tool trust, where manifests, descriptions, and hosts can all change after approval.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 11:40 am
Agentic supply chain security is now an identity governance problem: Once an AI agent can select tools at runtime, the question is no longer only whether the agent is authorised. It is also whether the tool itself is trustworthy, mutable, and isolated. That expands governance from identity assignment to runtime trust assurance. Practitioners should treat tool provenance, manifest drift, and host tenancy as part of the access decision.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How do teams decide whether to use self-hosted or remote MCP servers?
A: Choose based on the level of control you need over credentials, logging, and system reach. Self-hosted deployments give more direct governance, while remote servers usually require stronger authentication and proxy controls. The deciding factor is not convenience alone, but whether you can enforce the same policy standard end to end.
👉 Read our full editorial: Agentic supply chain security is now part of identity governance