Topic starter
14/08/2026 6:33 pm
TL;DR: The move into code, Cowork, skills, MCP servers, and agent workflows creates a security gap unless teams can inspect prompts, tool calls, and tool outputs before action is taken, according to Cato Networks. The governing assumption is shifting from session visibility to runtime control over what an agent can see, request, and do.
Editorial analysis by NHI Mgmt Group, based on content published by Cato Networks: “How Cato AI Security Keeps Up With Claude”.
Key questions
Q: How should security teams govern Claude Enterprise agent access when MCP is involved?
A: Treat MCP as both a transport layer and an execution surface.
Q: Why do legitimate agent tools become risky when combined?
A: Because the combined permission set can exceed the task boundary even if each tool is acceptable on its own.
Q: What are the signs that runtime AI controls are not enough?
A: Common warning signs include unexplained tool usage, policy drift across sessions, repeated dependency on broad inherited access, and incidents that can only be explained after the fact.
Practitioner guidance
- Inspect the full tool chain Map every Claude-connected skill, MCP server, and workflow tool to the actions it can trigger, then compare that effective reach against the intended task boundary.
- Enforce runtime policy across the session Apply controls to the prompt, model response, tool input, and tool output so unsafe behaviour can be stopped after the first request but before action completion.
- Review combined permissions, not isolated approvals Validate whether two individually legitimate tools become unsafe when used together, especially when one tool can change files or execute code.
Bottom line: Claude now sits inside an action path that includes tools, skills, and MCP servers, so security has to govern what the agent can do as well as what it can read.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:38 pm
Tool governance is now the control plane for Claude security: once an assistant can act through skills, MCP servers, and workflow tools, the primary security question shifts from conversation safety to delegated capability control. The problem is no longer only what the model says, but what it can reach and trigger through attached tools. Practitioners should treat tool governance as an identity and access problem, not a feature-management problem.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How do Claude-style agent controls differ from traditional application security?
A: Traditional application security focuses on the app, the endpoint, or the network path. Claude-style controls have to govern a live interaction chain that includes prompts, model responses, tool input, and tool output, because the security decision happens while the system is acting, not only when it starts.
👉 Read our full editorial: Claude security now depends on governing tools, skills, and MCP