Notifications
Clear all
Topic starter
20/08/2026 5:48 pm
TL;DR: Model Context Protocol traffic can bypass traditional DLP, IAM, and SIEM assumptions because agent calls look like normal API activity and exfiltration happens through tool invocations, not file transfers, according to Nightfall’s 2026 MCP monitoring checklist. The practical issue is not visibility alone, but building protocol-level, identity-aware controls around AI agent access and data movement.
NHIMG editorial — based on content published by Nightfall: How to Monitor MCP Usage: A 10-Step Security Checklist for 2026
By the numbers:
- In July 2025, researchers found 1,862 exposed Model Context Protocol servers on the public internet.
- By late 2025, 43% of public MCP servers were vulnerable to command injection.
- By April 2026, a by-design RCE flaw in Anthropic's official SDK affected more than 7,000 publicly accessible servers.
Questions worth separating out
Q: How should security teams govern MCP in enterprise environments?
A: Treat MCP as an identity and authorization problem first.
Q: Why do MCP tools create a governance problem for IAM teams?
A: MCP turns each tool into a potential permission boundary, which means IAM teams must govern many small access decisions instead of one broad application login.
Q: What breaks when DLP is only tuned for file-based exfiltration?
A: File-based DLP misses the most important MCP risk, which is sensitive information moving inside tool calls and synthesized responses rather than attachments or downloads.
Practitioner guidance
- Inventory every MCP server and connector Create a living register of every MCP server, endpoint, tool, owning team, and identity path.
- Enforce authentication and scope hygiene for each connection Require SSO with MFA, validate session tokens against the identity provider, and eliminate anonymous sessions, shared credentials, and static keys that outlive their purpose.
- Define least privilege at the tool level Review every MCP tool as its own entitlement and re-evaluate permissions whenever the connector, integration, or owning business process changes.
What's in the full article
Nightfall's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance for building a 10-step MCP monitoring programme across discovery, logging, and enforcement.
- Protocol-level inspection patterns for tool calls and responses that go beyond classic file-based DLP.
- Practical examples of gateway-based enforcement, SIEM integration, and AI-native DLP in MCP environments.
- The article's breakdown of common MCP deployment patterns across developer endpoints, SaaS tools, and custom integrations.
👉 Read Nightfall's 10-step checklist for monitoring MCP usage in 2026 →
MCP observability and AI agent traffic: are your controls ready?
Explore further
20/08/2026 6:28 pm
MCP has become an identity plane, not just an integration layer: Once an AI agent can invoke tools, every connector becomes a governed access path with its own authentication, authorization, logging, and revocation requirements. Security teams that treat MCP as a developer convenience will miss the fact that it behaves like a distributed NHI estate. The practitioner conclusion is straightforward: govern MCP the way you would any other production identity surface.
A few things that frame the scale:
- While 71% of IT teams have been advised on AI agent data access, only 47% of compliance teams, 39% of legal teams, and 34% of executives have the same visibility, according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, which leaves 48% without a complete compliance and investigation trail.
A question worth separating out:
Q: How do organisations know whether MCP enforcement is actually working?
A: The clearest sign is that every meaningful agent action produces a consistent attestation trail and can be blocked when the session lacks provenance. If requests still succeed through direct APIs, side connectors, or browser clicks without governance metadata, enforcement is incomplete and the control plane is not authoritative.
👉 Read our full editorial: MCP observability exposes the limits of legacy DLP and IAM
