Notifications
Clear all
Topic starter
17/08/2026 5:39 pm
TL;DR: MCP risk is less about visible misconfiguration than silent identity and permission drift, where agents remain broadly permitted long after their original task, according to Unosecur. The core problem is that access review assumptions fail when agent behaviour changes faster than traditional IAM processes can follow, and security teams need lifecycle controls, ownership, observability, and revocation discipline to govern this over time.
NHIMG editorial — based on content published by Unosecur: The MCP Security Checklist: How to Govern AI Agents Without Slowing Them Down
By the numbers:
- Only 18% of MCP server deployments implement any form of access scoping for tool permissions.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
- 53% of MCP servers expose credentials through hard-coded values in configuration files.
Questions worth separating out
Q: What breaks when MCP agents are given broad permissions?
A: Broad permissions turn one compromised or manipulated agent into a wide-blast-radius identity.
Q: Why do MCP and agentic AI complicate IAM governance?
A: Because IAM controls are usually built around stable identities, known purposes, and review cycles that assume access remains legible long enough to inspect.
Q: How can security teams tell whether AI agent access is drifting out of scope?
A: Look for agents touching systems, data sets, or tools that are outside the intended task boundary, especially when those actions are not part of the approved workflow.
Practitioner guidance
- Inventory every agent identity and MCP server Create a continuously updated register that links each agent to a named owner, purpose, tool list, and permitted data scope.
- Scope tool permissions per client and per task Avoid broad server-level permissions when a narrower tool-level boundary is possible.
- Log sequence, intent, and outcome for agent actions Capture the order of tool calls, the context of the request, and the result so security teams can distinguish legitimate behaviour from drift.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step MCP readiness checklist for pre-production approval and runtime governance
- Practical examples of identity inventory, ownership, and revocation checks across agent environments
- Detailed guidance on logging, containment, and kill-switch behaviour for live MCP deployments
- Question-by-question checklist format that implementation teams can adapt for internal review
👉 Read Unosecur's MCP security checklist for AI agent governance →
MCP security checklist: are your agent controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 5:40 pm
Lifecycle drift is the real MCP security problem, not a missing control. The article is right to frame MCP as a lifecycle issue because agents do not fail in the classic sense. They remain valid, keep working, and slowly expand their practical reach until the original approval no longer describes reality. That means identity, trust, and privilege have to be revalidated over time, not just at onboarding.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 48% of organisations say they have a complete blind spot because they cannot track and audit the data their AI agents access, according to the same report.
A question worth separating out:
Q: Who is accountable when an MCP agent accesses the wrong resource?
A: Accountability sits with the teams that defined consent, token handling, and policy review for the MCP deployment. If token passthrough, weak audience checks, or incomplete client approval allowed the request, that is a governance failure, not an agent anomaly. Frameworks such as NIST CSF and Zero Trust architecture expect explicit access validation.
👉 Read our full editorial: MCP security checklist reframes agent risk as lifecycle governance
