Topic starter
30/07/2026 10:52 pm
TL;DR: Among 200-plus popular MCP servers and agent Skills in production, 76% of MCP servers carry high-risk capabilities, one in four expose arbitrary code execution, and 62% of Skills have risky characteristics with no audit trail, according to Noma Security. The findings show agentic AI risk is split across visible and invisible layers that current tooling does not govern well.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “No Excessive CAP”.
By the numbers:
- 76% of MCP servers carry high-risk capabilities.
- 1 in 4 expose arbitrary code execution.
- 62% of Skills carry risky characteristics with no audit trail.
Key questions
Q: What breaks when MCP-connected agents are not tightly governed?
A: When MCP-connected agents are not tightly governed, teams lose visibility into which tools and data sources the agent can reach.
Q: Why do Skills with no audit trail create more governance risk than simple automation?
A: Because the issue is not only what the workflow can do, but whether security teams can reconstruct how it did it.
Q: What do security teams get wrong about AI agent permissions?
A: Teams often assume that permissions are safe if the agent was approved at deployment.
Practitioner guidance
- Map every agent capability path Inventory all MCP servers and Skills that an agent can invoke, then classify each by data reach, command reach, and code execution potential.
- Separate capabilities from permissions Assign different approval thresholds for what an agent can do, what it can access, and whether it can act without human intervention.
- Require task-level traceability Make audit logging a release gate for any Skill or MCP integration that can alter records, call external tools, or trigger downstream actions.
Bottom line: MCP servers and Skills expand agentic AI risk in different ways, but both create non-human access paths that identity teams must govern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:55 pm
Agentic AI governance now fails at the capability boundary, not only at the model boundary. The article shows that MCP servers and Skills expose different layers of risk, which means identity teams can no longer govern agents by model approval alone. The critical issue is whether runtime capability, autonomy, and permissions are being treated as separate controls. Practitioners should assume that the most dangerous agentic AI exposure sits between the model and the tool, where governance is weakest.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern agentic AI when the model can act across multiple tools and services?
A: Teams should govern the full execution path, not just the model endpoint. The practical control is a replayable event history that records tool calls, context updates, and decisions in order, so security and compliance can reconstruct what happened. Without that trace, incident response and audit become guesswork.
👉 Read our full editorial: AI agent attack surface grows through MCP and Skill risk