Topic starter
25/10/2026 11:04 am
TL;DR: Runtime controls for MCP only enforce policy when every path stays inside inspection, PipeLab reports, based on the NSA’s May 2026 guidance. MCP governance has to cover discovery, sandboxing, logging, and in-path enforcement as separate controls.
Editorial analysis by NHI Mgmt Group, based on content published by PipeLab: “What the NSA's MCP security guidance says, and what an agent firewall does”.
Key questions
Q: Why do MCP runtime controls need both discovery and inspection?
A: Discovery tells you whether an MCP server should be trusted enough to install or expose, while inspection tells you whether a specific live call is safe to execute.
Q: How should teams decide whether to use an MCP proxy or a scanner?
A: Use both for different decisions.
Q: What breaks when MCP traffic can bypass runtime inspection?
A: Policy becomes advisory instead of enforced.
Practitioner guidance
- Enforce direct egress restrictions Block bypass paths with network policy or container network rules so the proxy is the only governed route for MCP traffic.
- Separate discovery from runtime inspection Use pre-deploy scanners to assess exposed MCP servers, then use runtime proxies to inspect live calls before execution.
- Pin tool inventory during each session Fingerprint tool names, descriptions, and parameters so drift or collision is visible before the agent reuses a changed tool.
Bottom line: MCP security is now about controlling live agent traffic, not just validating server exposure before deployment.
Glossary terms: MCP proxy, Tool Inventory Pinning, Bidirectional Inspection, Egress Bypass Risk
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Runtime inspection becomes the control plane for MCP trust: When agents call tools dynamically, policy cannot live only in pre-deployment review. The meaningful boundary is the point where the request and response are still observable, because that is where exfiltration, injection, and unsafe tool chaining can still be stopped. In practice, runtime inspection is not a bolt-on feature; it is the place where governance either exists or is bypassed.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should IAM teams monitor to prove MCP governance is working?
A: IAM teams should monitor which workload identities are calling which servers, whether policy is default-deny, and whether outbound requests are auditable back to the calling agent. If those signals are missing, the environment may be relying on implied trust rather than enforced identity controls.
👉 Read our full editorial: Runtime controls for MCP need proxy inspection and DLP
This post was modified 7 days ago by NHI Mgmt Group