MCP discovery turns tool access into an identity governance problem because each exposed tool becomes a potential action surface. Teams should assume new tools are sensitive until they are classified, approved, and tied to a clear user or agent purpose. Without that, runtime discovery can outrun policy.
Why This Matters for Security Teams
When MCP tools are discovered at runtime, the access problem changes from “who can log in” to “what can the agent or user do right now.” That shifts control from static account provisioning to tool-level governance, where each newly exposed capability should be treated as a sensitive action surface until it is classified and approved. The risk is not theoretical: NHIMG’s Astrix Security research on MCP server security found that only 18% of deployments implement any form of access scoping for tool permissions.
This is why traditional IAM reviews often miss the real exposure. A tool can appear after policy design, inherit overly broad trust, or be callable by an agent that can chain actions faster than human reviewers can react. Guidance from the OWASP Top 10 for Agentic Applications 2026 and NHIMG’s Ultimate Guide to NHIs both point to the same operational reality: dynamic capability discovery demands dynamic authorization. In practice, many security teams encounter tool abuse only after an agent has already invoked an unapproved action, rather than through intentional policy design.
How It Works in Practice
Runtime-discovered MCP tools should be governed as ephemeral entitlements, not as permanent application features. The practical model is to combine workload identity, intent-aware authorization, and just-in-time approval so that a tool is not usable simply because it exists. The agent presents cryptographic proof of workload identity, the policy engine evaluates whether the requested action matches the declared task, and the system issues a short-lived token only if the request is within scope. This aligns with current Zero Trust guidance in CIS Controls v8 and with the policy-first direction in NIST SP 800-53 Rev 5.
A workable implementation usually includes:
- Tool registration with owner, purpose, data sensitivity, and expiration date before broad exposure.
- Per-tool or per-method allowlisting instead of blanket access to the whole MCP server.
- Short TTL credentials for the agent, with automatic revocation when the task ends.
- Real-time policy evaluation using context such as user intent, agent role, data classification, and transaction risk.
- Logging that records which tool was discovered, by which workload identity, and under what approval path.
NHIMG’s NHI Lifecycle Management Guide is useful here because runtime discovery should be treated as a lifecycle event, not just an integration event. For teams building agentic systems, the OWASP Agentic AI Top 10 reinforces that tool exposure, privilege escalation, and unsafe chaining are part of the same control problem. These controls tend to break down in loosely governed MCP hubs where tool metadata is incomplete and the server exposes capabilities faster than policy can classify them.
Common Variations and Edge Cases
Tighter runtime control often increases friction for developers and operators, so organisations have to balance velocity against blast-radius reduction. That tradeoff becomes visible in environments where tools are created frequently, ownership is distributed, or agents are allowed to discover new capabilities without a human approval checkpoint.
Best practice is evolving for a few edge cases. In some teams, a newly discovered tool is allowed read-only access immediately, while write or destructive actions remain blocked until review. In others, policy is tied to environment labels so that the same tool is approved in a sandbox but denied in production. There is no universal standard for this yet, but the direction is clear: runtime discovery should not equal runtime trust. For broader NHI governance context, NHIMG’s Top 10 NHI Issues shows how quickly weak scoping and poor secret handling compound one another.
One important exception is legacy MCP deployments that cannot enforce per-tool policy at the server layer. In those cases, teams often place a broker or gateway in front of the server to mediate discovery and inject controls, but that adds latency and operational complexity. The OWASP Non-Human Identity Top 10 remains relevant because the underlying issue is still unmanaged machine identity, even when the tools are discovered dynamically.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A01 | Runtime tool discovery expands agent attack surface and unsafe tool use. |
| CSA MAESTRO | A2 | Covers agent autonomy, tool access, and runtime policy governance. |
| NIST AI RMF | GOVERN | Requires accountable governance for dynamic AI decision-making and access. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Dynamic MCP tools behave like sensitive machine identities and secrets. |
| NIST CSF 2.0 | PR.AC-4 | Least privilege and access management fit runtime-discovered tool control. |
Assign ownership, approval, and audit responsibility for discovered tools and agent actions.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
