Topic starter
13/08/2025 12:04 pm
TL;DR: More than 5,200 open-source MCP server implementations reveal that 88% require credentials, 53% rely on long-lived static secrets, and only 8.5% use OAuth, exposing a growing AI-agent attack surface, according to Astrix Security. MCP is becoming operationally useful faster than identity governance can keep up, so the trust model now matters as much as the integration model.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “The MCP ShiftPart 1: The Problem”.
By the numbers:
- Astrix Security says 88% of more than 5,200 open-source MCP server implementations require credentials.
- Astrix Security says 53% rely on long-lived static secrets, including API keys and Personal Access Tokens.
- Astrix Security says only 8.5% use OAuth.
Key questions
Q: Where does MCP fail when multiple AI agents share the same credential model?
A: It fails when one credential is used to represent many actors, because attribution, revocation, and least privilege all become ambiguous.
Q: Why do long-lived secrets increase enterprise risk?
A: Long-lived secrets increase risk because they remain usable long after exposure.
Q: What are the warning signs that MCP access is not properly controlled?
A: Warning signs include hard-coded credentials in server files, broad tool permissions, no per-tool ownership, and logs that cannot show which agent made a call.
Practitioner guidance
- Inventory MCP credentials as governed NHIs Map every API key, personal access token, and other secret used by MCP servers, agents, and scripts to an owner, purpose, and expiry condition.
- Separate agent identity from transport access Require a distinct non-human identity for each AI agent or workflow instead of allowing shared tokens to represent multiple actors or use cases.
- Replace long-lived secrets with time-bound access Reduce reliance on static secrets by scoping credentials to the shortest practical task window and revoking them when the task ends.
Bottom line: MCP’s risk is not only technical connectivity but the identity and audit gap created when agents act through shared credentials.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 5:09 pm
MCP identity debt is becoming the hidden cost of AI integration: The central risk is not that MCP exists, but that it often inherits the weakest parts of the identity stack while looking like a neutral connector. When agents, scripts, and tools share static credentials, the governance problem shifts from access grant to access archaeology. Practitioners should read MCP as a compounding identity layer, not a simple interoperability layer.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do IAM teams keep MCP from becoming another unmanaged NHI sprawl problem?
A: IAM teams should inventory every MCP connection as a governed identity relationship, not a one-off developer convenience. The controls that matter are entitlement minimisation, approval for sensitive tools, periodic recertification, and clean offboarding. Without that discipline, MCP adoption simply multiplies machine identities faster than governance can catch up.
👉 Read our full editorial: Mcp server identity blind spots are widening enterprise ai risk