MCP on endpoints: what security teams are missing in inventory

TL;DR: MCP has moved into enterprise endpoints faster than inventories can track, and Pluto Security reports a median 288 servers per organization alongside risks from unreviewed code, unauthenticated local listeners, and tool-poisoning paths that can redirect agents and flatten identity boundaries. The assumption that install-time approval captures runtime authority no longer holds once agents inherit files, credentials, and network reach from every server they load.

Editorial analysis by NHI Mgmt Group, based on content published by Pluto Security: “The MCP Debrief – What’s Actually Running on Your Endpoints”.

By the numbers:

• The median organization runs 288 distinct MCP servers across its endpoints.
• Across four customer environments, the number of distinct MCP servers on employee endpoints grew by 72% to 98% between May and August 2026.
• Of endpoints running at least one MCP server, 86% connect to a remote server and 57% run a local process.

Key questions

Q: What breaks when MCP servers are deployed outside normal inventory paths?

A: When MCP servers bypass normal inventory paths, security teams lose the ability to prove what tools exist, who owns them, and which agents can call them.

Q: Why do endpoint MCP servers create more risk than ordinary desktop tools?

A: They are not just applications; they are delegated access paths.

Q: What are the signs that an MCP server is failing its security boundary?

A: A security boundary is failing when a server exposes more tools than a given agent needs, returns data outside the intended session context, or lacks clear audit trails for tool calls.

Practitioner guidance

• Build an MCP inventory from the endpoint up Track every local and remote server, its owner, version, startup command, transport, listening interface, and client so discovery is not dependent on ad hoc reports.
• Require authentication on every listener Do not let localhost, network location, or a development tunnel stand in for identity; every HTTP or SSE endpoint should require a real caller check.
• Constrain server authority to the task Grant only the files, processes, network destinations, and downstream scopes needed for the current invocation, then remove them when the task ends.

Bottom line: MCP turns endpoint-installed servers into delegated authority surfaces, so the security problem is as much about inherited access as it is about code quality.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →