Shadow MCP refers to the unauthorized use of Model Context Protocol servers on organization devices. Bifrost provides the visibility and governance tools needed to identify and secure these connections.
The Model Context Protocol (MCP) is an open standard that allows large language models (LLMs) to access local data, execute code, and query external databases. While this protocol enables highly capable AI agents, it also introduces a new category of security risk known as Shadow MCP. Bifrost, an open-source AI gateway developed by Maxim AI, provides the infrastructure to bridge this visibility gap by centralizing how AI tools interact with local and remote resources.
What is Shadow MCP
Shadow MCP is the usage of MCP servers and tool configurations by employees without the knowledge or authorization of the organization's security and IT teams. It is a subset of "Shadow AI" where users connect their AI chat applications, such as Claude Desktop or ChatGPT, to local tool servers that can read files, access internal APIs, or interact with system processes.
Because MCP servers are often lightweight and easy to run locally, users frequently install them to automate repetitive tasks. However, these servers operate outside the typical enterprise security perimeter. Without a centralized governance layer, security teams cannot see which tools the AI is using, what data is being accessed, or whether those tools are being used to exfiltrate sensitive information.
The Security Risks of Ungoverned MCP Servers
When an employee runs an ungoverned MCP server, they create a direct conduit between a third-party LLM and their company machine. Several technical risks emerge from this architecture:
- Data Exfiltration: An MCP server designed to read files could be used by an AI model to summarize and then upload sensitive company documents to an external provider.
- Unvetted Tool Execution: Many open-source MCP servers found in public repositories lack rigorous security audits. These servers might contain vulnerabilities or malicious code that can execute commands on the host machine.
- Lack of Audit Trails: Most AI desktop applications do not provide detailed logs of which tools were called, what arguments were passed, or what data was returned. This makes incident response nearly impossible.
- Credential Exposure: MCP servers often require API keys or environment variables to connect to other services. In a shadow environment, these credentials are stored locally and are often unencrypted.
To mitigate these risks, organizations must move from individual, localized tool configurations to a centralized MCP gateway that provides a single point of enforcement for all AI tool traffic.
How to Detect Shadow MCP on the Endpoint
Detecting Shadow MCP requires visibility into the AI applications running on employee machines. Most organizations have no visibility into the internal configuration files where MCP servers are defined. Detection typically involves three primary methods:
Scanning Local Configuration Files
Many AI applications store their MCP configurations in standard locations. For example, Claude Desktop stores its configuration in a claude_desktop_config.json file. Security teams can use scripts to scan for these files, but this method is often reactive and can be bypassed by users moving files or using different applications.
Network Traffic Analysis
Organizations can monitor for traffic patterns associated with known MCP providers or unexpected outbound API calls. However, because MCP traffic is often encrypted and looks like standard HTTPS traffic to an LLM provider, this method frequently results in false negatives.
Endpoint AI Governance
The most effective way to detect Shadow MCP is through dedicated endpoint agents. Bifrost Edge runs as an always-on agent on macOS, Windows, and Linux devices. It automatically inventories the MCP servers configured inside applications like Claude Desktop, Cursor, and Gemini CLI. This provides a live, fleet-wide inventory of every MCP server running on every machine in the organization.
Governing the Last Mile with Bifrost Edge
Bifrost applies governance and security controls such as virtual keys, budgets, and guardrails centrally, and Bifrost Edge extends that same governance and security to AI traffic on employee machines with endpoint enforcement on each device.
By using the combination of the AI gateway as a control plane and Bifrost Edge as the endpoint layer, administrators can transition from detection to active prevention. The approvals dashboard in Bifrost allows teams to review discovered MCP servers and mark them as approved or denied. Once a server is denied, Bifrost Edge blocks its execution on the device, ensuring that only vetted applications can interact with company data.
Implementation: Fleet-Wide MCP Visibility
For enterprise teams, manual detection is not scalable. Organizations can deploy Bifrost Edge using Mobile Device Management (MDM) platforms such as Jamf, Microsoft Intune, or Kandji. A managed MDM deployment ensures that every computer in the organization is automatically brought under the centralized governance policy.
Once deployed, Bifrost populates the devices dashboard, which lists every host, its owner, and the specific AI applications and MCP servers detected on the machine. This allows security teams to answer critical questions:
- Which employees are using experimental MCP servers?
- Are there unauthorized coding agents accessing internal source code?
- Is there a specific version of a server running that contains a known vulnerability?
Beyond simple blocking, the gateway allows for tool filtering. This means an organization can allow an MCP server but restrict it to specific tools or functions, providing a more granular level of access control.
Building a Secure AI Workflow
Securing the Model Context Protocol requires a shift in how infrastructure is managed. Relying on users to self-report their tool usage is insufficient for modern security standards. By implementing a centralized governance hub and extending it to the endpoint, organizations can enable their teams to use AI tools productively without compromising the security of the corporate environment.
Teams evaluating their AI security posture can request a Bifrost demo to see these governance tools in action or explore the open-source repository to understand the underlying architecture.
Top comments (0)