Notifications
Clear all
Topic starter
24/06/2026 7:24 pm
TL;DR: DIY MCP servers create hidden production costs in authentication, governance, observability, and maintenance as adoption scales, according to Kong, with over 16,000 MCP servers now in the wild and shadow AI already linked to breaches and higher incident costs. The core issue is that MCP makes agent-to-tool access easier, but it also expands identity, audit, and lifecycle burden faster than most teams expect.
NHIMG editorial — based on content published by Kong: Build vs Buy: The Hidden Costs of DIY MCP Server Infrastructure
By the numbers:
- One in five organizations reported a breach due to shadow AI, and only 37% have policies to manage AI or detect shadow AI.
- For Fortune 500 companies, downtime costs average $500,000 to $1 million per hour.
Questions worth separating out
Q: What breaks when MCP servers are built without central governance?
A: Without central governance, MCP servers multiply into an unmanaged access layer.
Q: Why do MCP environments create more identity risk than standard API integrations?
A: MCP environments increase identity risk because they add tool discovery, delegated access, and multiple authentication paths on top of existing APIs.
Q: How do teams know if their MCP governance is actually working?
A: Governance is working when every MCP tool has a named owner, a clear approval record, a retirement path, and traceable authentication logs.
Practitioner guidance
- Map every MCP server to an owner and decommissioning path Require a named business owner, technical owner, and retirement trigger for each tool.
- Centralise authentication patterns across tools and environments Standardise OAuth, JWT, and API key handling through a common control plane so each MCP server does not invent its own trust model.
- Instrument per-tool audit and failure telemetry Capture request context, token outcome, error class, latency, and tool identity for every invocation.
What's in the full article
Kong's full blog covers the operational detail this post intentionally leaves for the source:
- A side-by-side build versus buy comparison for MCP infrastructure at enterprise scale
- Operational examples of governance, observability, and retry handling across AI agent tool calls
- The specific Kong platform components used to centralise discovery, auth, and monitoring
- Implementation detail on how existing API assets are exposed to MCP-accessible tools
👉 Read Kong's analysis of the hidden costs of DIY MCP server infrastructure →
DIY MCP server infrastructure: where do identity controls break down?
Explore further
25/06/2026 4:41 am
MCP creates an identity control plane problem, not just an integration problem. Once AI agents can discover and invoke tools through a common protocol, the enterprise is no longer managing isolated scripts. It is governing a distributed access layer with multiple auth methods, ownership domains, and audit requirements. That means MCP belongs in the same governance conversation as API security, NHI lifecycle, and privileged access, not in a developer convenience bucket. Practitioners should treat the protocol as infrastructure that expands identity scope, not as glue code that sits outside policy.
A few things that frame the scale:
- One in five organizations reported a breach due to shadow AI, and only 37% have policies to manage AI or detect shadow AI, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What is the difference between a prototype MCP server and production MCP infrastructure?
A: A prototype proves that an agent can call a tool. Production infrastructure proves that the call is secure, auditable, resilient, and owned over time. The difference is not just scale. It is whether the access path can survive token expiry, team turnover, policy changes, and incident response without becoming unmanageable.
👉 Read our full editorial: DIY MCP server infrastructure hides growing identity and governance costs
