Topic starter
11/08/2026 3:16 pm
TL;DR: MCP server metadata can carry plain-English instructions that influence AI agent behaviour, creating a second trust path beyond code, according to Island’s analysis of 33,563 published builds and 475,865 tools. Conventional software scanning misses this instruction supply chain, so agent governance now has to cover descriptions, return values, and runtime approval as well as package integrity.
Editorial analysis by NHI Mgmt Group, based on content published by Island: “MCP Server Security Risks: What Scanning 33K Builds Found”.
By the numbers:
- 49% of server builds produced at least one non-informational finding in Island’s scan.
Key questions
Q: What breaks when MCP tool descriptions are treated as harmless documentation?
A: Security teams miss a second instruction channel that can steer the model even when the package is clean.
Q: Why do plain-English MCP instructions create governance risk for AI agents?
A: Because the model may treat descriptive text as operational guidance once the host exposes the tool and the agent calls it.
Q: How do security teams know whether MCP server governance is working?
A: They should be able to answer four questions at any time: what servers exist, which are official, what credentials they can use, and what systems they contact.
Practitioner guidance
- Inspect tool descriptions before approval Review MCP tool descriptions, prompts, and returned text for directive language that could steer the model, not just for code defects.
- Gate high-risk tools at runtime Require session-level authorisation for tools that can read sensitive data, execute commands, or alter logs, and revoke access after each approved action.
- Rescan every MCP version change Treat each MCP update as a fresh trust decision because a later release can introduce covert instructions or new execution capability.
Bottom line: MCP changes the threat model by adding an instruction layer to supply-chain risk, not just a code layer.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 hours ago by NHI Mgmt Group
11/08/2026 3:28 pm
MCP instruction supply chain is now a governance problem, not just a code problem: the article shows that a tool can be technically safe and still manipulate an agent through plain-English metadata. That changes the control objective from scanning packages to governing what a model is exposed to at discovery, approval, and execution. For identity and AI teams, the key point is that authority is being exercised through context, not only through executable code. Practitioners should treat tool descriptions and return values as policy-bearing inputs.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat MCP approvals as a security control or a usability choice?
A: Security control. Approvals determine which tools an AI system can reach, which actions it can trigger, and how quickly damage can spread if a token is misused. If approvals are broad or permanent, they become standing delegation for the agent, so they should be governed like privileged access.
👉 Read our full editorial: MCP instruction supply chains are creating new AI security risk
This post was modified 3 hours ago by NHI Mgmt Group