DIY MCP server infrastructure: where do identity controls break down?

TL;DR: DIY MCP servers create hidden production costs in authentication, governance, observability, and maintenance as adoption scales, according to Kong, with over 16,000 MCP servers now in the wild and shadow AI already linked to breaches and higher incident costs. The core issue is that MCP makes agent-to-tool access easier, but it also expands identity, audit, and lifecycle burden faster than most teams expect.

NHIMG editorial — based on content published by Kong: Build vs Buy: The Hidden Costs of DIY MCP Server Infrastructure

By the numbers:

• One in five organizations reported a breach due to shadow AI, and only 37% have policies to manage AI or detect shadow AI.
• For Fortune 500 companies, downtime costs average $500,000 to $1 million per hour.

Questions worth separating out

Q: What breaks when MCP servers are built without central governance?

A: Without central governance, MCP servers multiply into an unmanaged access layer.

Q: Why do MCP environments create more identity risk than standard API integrations?

A: MCP environments increase identity risk because they add tool discovery, delegated access, and multiple authentication paths on top of existing APIs.

Q: How do teams know if their MCP governance is actually working?

A: Governance is working when every MCP tool has a named owner, a clear approval record, a retirement path, and traceable authentication logs.

Practitioner guidance

• Map every MCP server to an owner and decommissioning path Require a named business owner, technical owner, and retirement trigger for each tool.
• Centralise authentication patterns across tools and environments Standardise OAuth, JWT, and API key handling through a common control plane so each MCP server does not invent its own trust model.
• Instrument per-tool audit and failure telemetry Capture request context, token outcome, error class, latency, and tool identity for every invocation.

What's in the full article

Kong's full blog covers the operational detail this post intentionally leaves for the source:

• A side-by-side build versus buy comparison for MCP infrastructure at enterprise scale
• Operational examples of governance, observability, and retry handling across AI agent tool calls
• The specific Kong platform components used to centralise discovery, auth, and monitoring
• Implementation detail on how existing API assets are exposed to MCP-accessible tools

👉 Read Kong's analysis of the hidden costs of DIY MCP server infrastructure →

DIY MCP server infrastructure: where do identity controls break down?

Explore further

View Full Forum →  |  NHI Foundation Course →