Notifications
Clear all
Topic starter
19/08/2026 3:26 pm
TL;DR: MCP server adoption creates a governance gap when tools are discovered through scattered URLs, public catalogs, and chat threads, because there is no authoritative source for approval status or access scope, according to Stacklok. The security issue is not discovery alone but whether registry filtering and claims-based authorization happen at the API layer, where AI agents inherit the same controls as users.
NHIMG editorial — based on content published by Stacklok: MCP server governance starts with discovery and claims-based access
By the numbers:
- Only 18% of MCP server deployments implement any form of access scoping for tool permissions.
- 53% of MCP servers expose credentials through hard-coded values in configuration files.
Questions worth separating out
Q: How should security teams govern MCP in enterprise environments?
A: Treat MCP as an identity and authorization problem first.
Q: Why do MCP tools create a governance problem for IAM teams?
A: MCP turns each tool into a potential permission boundary, which means IAM teams must govern many small access decisions instead of one broad application login.
Q: What breaks when MCP tools are filtered only in the user interface?
A: The control breaks as soon as an AI agent or API client can still reach the underlying endpoint.
Practitioner guidance
- Build an authoritative MCP registry Centralise server discovery in a governed registry that records source type, approval status, and entitlement scope instead of relying on shared URLs or informal catalogs.
- Enforce access at the API layer Apply authorization before tool metadata is returned so AI agents and users receive the same entitlement decisions from the registry endpoint.
- Map registry claims to identity groups Bind source visibility to existing IdP group claims so shared, engineering, and finance tools are separated without creating a second identity system.
What's in the full article
Stacklok's full how-to covers the operational detail this post intentionally leaves for the source:
- Step-by-step MCPRegistry deployment on Kubernetes, including the operator, resource definition, and sync setup.
- Full config examples for Git, upstream API, and Kubernetes discovery sources with filter logic and annotations.
- OAuth and OIDC configuration details for per-user catalog views and role-based source visibility.
- Live demo flow showing how the registry behaves before and after claims-based authorization is enabled.
👉 Read Stacklok's how-to on MCP server governance and claims-based access →
MCP server governance: is your catalog actually access controlled?
Explore further
19/08/2026 4:10 pm
MCP governance fails when discovery is treated as a navigation problem instead of an identity problem. A URL list, public catalog, or wiki page can tell users where a server lives, but it cannot tell the enterprise whether that server is approved, current, or in scope for a given identity. That leaves platform teams with inventory, not control. The practitioner conclusion is that MCP governance must start with authoritative registry ownership.
A few things that frame the scale:
- Only 18% of MCP server deployments implement any form of access scoping for tool permissions, according to Astrix Security's The State of MCP Server Security 2025.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, according to Astrix Security's The State of MCP Server Security 2025.
A question worth separating out:
Q: What frameworks help with MCP server governance and least privilege?
A: Use NIST Cybersecurity Framework 2.0 for access governance, OWASP NHI guidance for non-human identities, and OIDC-backed claims for source-level authorization. Those controls help teams separate inventory from entitlement and keep agentic workflows inside the same policy boundary as human users.
👉 Read our full editorial: MCP server governance starts with discovery and claims-based access
