Topic starter
06/07/2026 9:37 am
TL;DR: MCP makes it easier for AI models to reach files, tools, and enterprise data, but it also shifts the security problem to runtime authorisation, confused deputy risk, and shadow MCP deployments, according to Reva.AI. The governance gap is no longer about connectivity, but about who can trigger which action, in what context, and with what accountability.
Editorial analysis by NHI Mgmt Group, based on content published by Reva.AI: “Reva.ai”.
Key questions
Q: What breaks when MCP tools are connected without runtime authorisation?
A: The control boundary breaks at the point of action.
Q: Why do MCP servers increase risk when tool permissions are too broad?
A: MCP servers can expand risk because they sit between an AI client and sensitive backends, often with enough reach to query data, trigger workflows, or modify records.
Q: How do security teams detect shadow MCP access in practice?
A: They correlate client configuration, registry data, and network telemetry to identify servers that were installed outside approved workflows.
Practitioner guidance
- Define per-invocation authorization for MCP tools Require each tool call to evaluate user, agent, target action, and context before execution.
- Inventory shadow MCP servers across endpoints Discover local and unofficial MCP instances on developer machines, then map what data sources, files, and system privileges each server can reach.
- Reduce blanket permissions on MCP servers Remove repository-wide or filesystem-wide authority where the server only needs task-specific access.
Bottom line: MCP changes the enterprise problem from connecting AI systems to governing what those systems may do once connected.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:52 am
Tool invocation is now the governing boundary for MCP security: the protocol solved connectivity, but it did not solve authority. Once an agent can reach a tool, the enterprise still has to decide whether that specific action is allowed in that specific context. That makes invocation-time policy the real control plane for agent access.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should identity teams do about MCP governance and non-human identities?
A: Treat MCP servers and connected agents as governed non-human identities with ownership, approval scope, and offboarding requirements. That means they need inventory, policy review, and access reduction just like any other privileged machine-access pathway.
👉 Read our full editorial: MCP tool invocation is becoming the new enterprise perimeter