Because some risks live in the model's reasoning and context window, not in the gateway. A runtime can constrain secrets, policy, and execution blast radius, but it cannot fully validate intent flow or manage what the model has already absorbed into memory.
Why This Matters for Security Teams
MCP runtimes help, but they do not eliminate the core risk that an autonomous model can reason its way into unsafe actions after receiving broad context. The gateway can reduce secret exposure, tool abuse, and some execution paths, yet it cannot fully undo what the model has already inferred, cached, or chained across steps. That is why the gap between policy at the boundary and behaviour inside the context window matters so much.
This is especially visible in agentic environments where the model is not just answering questions but selecting tools, composing prompts, and carrying state forward. The practical issue is not only access to one tool, but the possibility of escalation across multiple tools after a benign-looking first step. NHI Management Group has documented how these risks show up across both identity and agentic attack surfaces in the Top 10 NHI Issues and the OWASP Agentic Applications Top 10. The latest OWASP guidance also aligns with the broader concern that runtime enforcement is necessary but not sufficient when the agent itself is the decision-maker.
In practice, many security teams encounter MCP weaknesses only after a tool chain has already moved data or credentials beyond the intended scope, rather than through intentional design-time review.
How It Works in Practice
An MCP runtime is best understood as a control plane, not a complete trust model. It can broker access to tools, scope which connectors are visible, and enforce some policy around secrets and requests. That helps, but a runtime cannot reliably prove intent, because intent is formed inside the model’s reasoning process, not in the protocol wrapper. Current guidance suggests treating MCP as one enforcement layer within a broader NHI and agent governance stack, not as the stack itself.
In a mature setup, the runtime should combine with workload identity, short-lived credentials, and real-time policy evaluation. The runtime issues or validates per-task access, but the underlying agent should present cryptographic workload identity, such as an OIDC-backed identity or SPIFFE-style workload identity, so the platform can verify what the agent is before it decides what the agent may do. That is the difference between static trust and task-scoped trust. NHI Management Group’s Astrix Security research on MCP server security shows why this matters: 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, which is a strong signal that configuration sprawl remains a live exposure path even when a runtime exists.
Practitioners should think in layers:
- Constrain tool visibility at the MCP layer.
- Use JIT, ephemeral secrets instead of long-lived credentials.
- Apply policy-as-code at request time, not only at registration time.
- Log tool calls, prompt lineage, and downstream actions for audit.
- Assume the model may retain or reuse sensitive context unless explicitly bounded.
For implementation guidance, the OWASP Top 10 for Agentic Applications 2026 and the NIST Cybersecurity Framework 2.0 both reinforce the need for continuous control validation rather than one-time gateway approval. These controls tend to break down when the agent can chain multiple tools across separate runtimes, because no single gateway has full visibility into the end-to-end task path.
Common Variations and Edge Cases
Tighter runtime control often increases friction for developers and operators, requiring organisations to balance security with agent usefulness and delivery speed. That tradeoff is real, especially in environments where agents must call many tools quickly or interact with semi-trusted internal systems. There is no universal standard for this yet, so best practice is still evolving.
One common edge case is the difference between protecting a single MCP server and governing a multi-agent workflow. A runtime may do a credible job on one connector, but a supervisor agent can still route work to a different tool, inherit context, or re-issue a request with altered framing. Another edge case is prompt memory and cached context. Even if a runtime revokes access after the task, the model may already have absorbed enough information to continue making unsafe inferences. That is why runtime controls should be paired with redaction, context minimisation, and explicit task boundaries.
For teams assessing the broader risk picture, NHIMG’s Analysis of Claude Code Security is useful because it illustrates how security posture changes when AI systems are allowed to operate directly on code, data, and workflows. The lesson is consistent: MCP helps govern execution, but it does not replace identity, policy, or agent-specific threat modelling. In high-autonomy environments, the question is not whether the gateway is secured, but whether the whole decision chain is.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Covers agent tool abuse and unsafe autonomous action paths. |
| CSA MAESTRO | GOV-02 | Addresses governance for agentic systems and runtime oversight. |
| NIST AI RMF | GOVERN | Applies accountability and oversight to AI system behaviour. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Relevant to secret sprawl and non-human identity misuse in MCP. |
| NIST CSF 2.0 | PR.AC-4 | Supports least-privilege access and authorization for runtime-controlled agents. |
Inventory every NHI secret, shorten TTLs, and remove static credentials from MCP configs.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
