Topic starter
22/09/2026 3:43 pm
TL;DR: Model Context Protocol is evolving from a tool-discovery layer into the identity plane for AI agents, and a May 2026 study of 7,973 live remote MCP servers found that 40.55% exposed tools with no authentication while every OAuth-enabled server tested had at least one flaw, according to P0 Security. The governance failure is that agents inherit whichever credentials the server holds, so authorization must be treated as NHI infrastructure, not optional plumbing.
NHIMG editorial — based on content published by P0 Security: Nobody built MCP servers to hold identity. They do anyway
By the numbers:
- A May 2026 study of 7,973 live remote MCP servers found that 40.55% expose their tools with no authentication at all.
- 300 CVEs have been filed against MCP infrastructure, astructure to date.
- Only 47.1% of deployed AI agents were actively monitored or secured in a February 2026 survey of 900-plus enterprise respondents.
Questions worth separating out
Q: What breaks when MCP servers do not require authentication?
A: When MCP servers do not require authentication, the access boundary disappears.
Q: Why do MCP servers create new authorization risks compared with traditional OAuth flows?
A: MCP changes the model because agents discover tools dynamically and may request capabilities after initial login.
Q: How can organisations tell whether MCP access is actually being governed?
A: A governed MCP deployment can answer who requested access, what scope was granted, when the token expires, and which tool calls were made under that token.
Practitioner guidance
- Inventory every MCP server as an identity-bearing resource Build a register of all remote and local MCP servers reachable from agents, including the credential type they hold, the scopes they request, and the business owner responsible for them.
- Replace static keys with per-call authorization Refuse shared API keys for production agent paths and require OAuth 2.1 or equivalent scoped credentials that are evaluated at invocation time, not cached for the life of a session.
- Bind access decisions to the initiating user and context Ensure the authorization check uses the real user or workflow trigger, not the first server that authenticated successfully, so delegated calls cannot inherit broader authority than intended.
What's in the full article
P0 Security's full analysis covers the operational detail this post intentionally leaves for the source:
- Measurement methodology behind the 7,973-server study and the authorisation flaws it found
- The specific MCP implementation patterns that produced auth gaps, including dynamic client registration issues
- Examples of exploit paths and protocol weaknesses described by the vendor
- The recommended server-side controls and deployment patterns in more implementation detail
👉 Read P0 Security's analysis of why MCP servers are becoming the identity plane for AI agents →
MCP authorization gaps: what identity teams need to control?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
22/09/2026 3:43 pm
MCP servers are now non-human identity infrastructure, not just integration plumbing. When a server holds credentials, defines scopes, and authorises tool calls, it is operating inside the identity perimeter whether teams acknowledge it or not. That makes MCP governance a direct extension of NHI governance, because the control question is no longer only what the agent can do, but which server is allowed to speak for it. Practitioners should classify every MCP server as a governed identity-bearing resource.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why shadow MCP risk is a governance problem as much as a technical one.
A question worth separating out:
Q: What is the difference between agent access and server access in MCP?
A: Agent access is the capability the AI system appears to have, while server access is the credential and policy layer that actually governs each tool call. In MCP, the server often decides what the agent can do in practice, which is why teams must manage the server as an identity control point rather than assuming the agent’s own permissions tell the full story.
👉 Read our full editorial: MCP servers are becoming the identity plane for AI agents
