MCP server security: inventory, approval and policy

What is an MCP server, and why does it matter?

The Model Context Protocol (MCP) is an open protocol that lets AI assistants connect to external tools and data sources. An MCP server exposes a set of tools, such as reading a ticket, querying a database or calling an internal API, and the assistant decides when to call them. The current version of the specification is dated 2026-07-28; in that revision each request declares its protocol version, and a server/discover call returns a server's supported versions and capabilities.

Because a developer can add a server in minutes, the set of servers in use can grow without review. A server installed without review can read data, run actions or receive secrets that end up in a tool call.

Source: Model Context Protocol: versioning · Reviewed Sep 2026

Step 1: find the servers in use

Inventory comes first because a policy needs a list to act on. Several of the tools we score describe discovery. Legit VibeGuard discovers assistants, models and MCP servers across the engineering organization. Snyk Evo Agentic Development Security discovers MCP servers, skills and tools. Endor Labs AURI inventories coding agents, models, MCP servers and skills. Cycode's AI-BOM tracks MCP servers with commit provenance, and OX VibeSec gives visibility into the MCP and AI stack.

Source: Legit Security: VibeGuard · Reviewed Sep 2026

Source: Snyk: Evo Agentic Development Security · Reviewed Sep 2026

Source: Endor Labs · Reviewed Sep 2026

Source: Cycode: AI security · Reviewed Sep 2026

Source: OX Security: VibeSec · Reviewed Sep 2026

Step 2: approve a short list

Once the list exists, decide which servers are allowed. Useful questions for each server: who maintains it, which systems it can reach, which credentials it holds, and whether it can write as well as read. VibeGuard lets security teams approve or block assistants, models and MCP servers, and Snyk Evo can evaluate, steer or block risky agent activity.

Keep the approved list short and review additions the way you review a new dependency: a named owner, a reason, and a date to look at it again.

Step 3: keep secrets out of tool calls

A tool call can carry whatever the agent has in context, including a key it read from a file. Cycode's AI Guardrails, launched on 17 February 2026, intercept secrets in prompts, file reads and MCP tool calls before they leave the IDE, and Cycode's AI page says it can block or warn on MCP tool calls that contain secrets or violate policy.

Source: Cycode: AI Guardrails · Reviewed Sep 2026

Source: Cycode: AI security · Reviewed Sep 2026

Step 4: record what agents call

A record of which servers and tools an agent used gives the security team something to review after an incident, and a way to check whether the policy works. OX Security's VibeSec documentation includes an agent activity log. Where a product does not record tool calls, a hook can: Claude Code hooks run at set points in the agent's lifecycle, and a PreToolUse hook can block a tool call before it runs.

Source: OX Security documentation index · Reviewed Sep 2026

Source: Claude Code hooks documentation · Reviewed Sep 2026

How does this show up in our scores?

MCP discovery and policy are part of coding agent guardrails, which carries 30% of the score. On that criterion Legit Security leads at 5.0, followed by Endor Labs, Snyk, Cycode and OX Security at 4.5.