The Security Risks of MCP Servers and How to Mitigate Them Across a Fleet

#ai #mcp #security #governance

[Model Context Protocol (MCP) servers grant AI agents powerful capabilities but also introduce significant security risks, including unauthorized data access and command execution. A unified AI gateway like Bifrost combined with an endpoint agent provides the visibility and control necessary to mitigate these risks across an entire fleet of machines.]

Model Context Protocol (MCP) is an emerging standard that allows AI models to interact with external tools and data sources, transforming them into capable agents. These agents can perform complex tasks by discovering and executing functions exposed by MCP servers. While this enables powerful new workflows, it also creates a substantial new attack surface. An unsecured MCP server can become a gateway for data exfiltration, unauthorized API calls, or lateral movement within a network. For organizations with hundreds or thousands of developers using these tools, securing this ecosystem at scale is a critical challenge.

Many security teams lack visibility into which MCP servers are being used on company devices. This "shadow agent" problem makes it impossible to enforce consistent security policies. Mitigating these risks requires a centralized approach that combines discovery, policy enforcement, and real-time governance. Platforms like Bifrost, an open-source AI gateway from Maxim AI, offer a control plane for this purpose, extending policy from the gateway to the individual developer's machine.

What are MCP Servers and Why Do They Pose a Risk?

An MCP server is an application that exposes a set of tools (functions, APIs, data sources) to an AI model, such as those used by agents like Claude Code or in editors like Cursor. The AI agent can query the MCP server to understand what tools are available and then request the execution of those tools to accomplish a goal.

The security risks stem from the capabilities granted to these tools:

Data Access: A tool might have the ability to read local files, access databases, or connect to internal APIs. An overly permissive tool could expose sensitive corporate or customer data.
Command Execution: Some tools may execute shell commands or run scripts. A vulnerability in such a tool could lead to arbitrary code execution on the host machine.
Unauthenticated Access: Many MCP servers are run locally by developers for convenience and may lack robust authentication, making them accessible to any process on the machine or even the local network.
Supply Chain Vulnerabilities: The tools themselves, often installed from public registries, can contain vulnerabilities. A compromised tool could be used to attack the agent or the underlying system.

Without a central inventory, security teams cannot know which developers are running which MCP servers, what tools those servers expose, or what data they can access. This lack of visibility makes it nearly impossible to conduct risk assessments or enforce security standards.

Fleet-Wide Mitigation Strategies for MCP Security

Securing a handful of MCP servers is a configuration task. Securing them across an entire organization's fleet of devices is a governance and infrastructure problem. An effective strategy requires three core components: visibility, control, and enforcement.

Discovery and Inventory: The first step is to build a comprehensive, real-time inventory of all MCP servers running across the fleet. You cannot secure what you cannot see. This requires an endpoint agent capable of detecting when AI applications like Claude Code or Cursor are configured to use an MCP server.
Centralized Policy Management: Once servers are discovered, administrators need a central place to approve or deny them. Policy should not be managed on individual machines. A central control plane allows for consistent rule application, such as denying all new servers by default until they are reviewed by a security team.
Endpoint Enforcement: A policy is only effective if it is enforced. An endpoint agent must be able to actively block connections to denied MCP servers, preventing AI models from executing their tools. This enforcement must happen on the device itself, before a request can be made.

This approach moves MCP security from an honor system to a governed ecosystem, ensuring that only vetted and approved tools are accessible to AI agents operating on company devices.

How Bifrost Governs MCP Servers at Scale

The Bifrost AI gateway and its endpoint component, Bifrost Edge, are designed to address the challenge of fleet-wide MCP governance directly. The platform provides the necessary layers of visibility, control, and enforcement. The gateway acts as the central policy engine, while the endpoint agent ensures those policies are applied everywhere.

Step 1: Discovering MCP Servers with Bifrost Edge

When deployed across a fleet via MDM solutions like Jamf or Intune, Bifrost Edge immediately begins inventorying AI tool usage.

Automated Discovery: The agent identifies AI applications on each machine and inspects their configurations to find connected MCP servers.
Fleet-Wide Inventory: This data is sent to a central admin dashboard, providing a unified, real-time view of every MCP server in use across the organization, deduplicated for clarity.
New Server Alerts: When a new, unknown MCP server is detected on any machine, it appears in an approval queue for review.

Step 2: Centralized Approval Workflows

Within the Bifrost admin console, security and platform teams can manage the entire lifecycle of an MCP server.

Approve or Deny: From the approvals dashboard, administrators can review each discovered server and explicitly approve or deny it.
Fleet-Wide Application: A single click applies the decision across every device running the Edge agent. Denying a server means no agent on any company machine can connect to it.
Default-Deny Posture: Organizations can configure a default-deny policy, ensuring no new MCP server can be used until it has been vetted and explicitly approved, significantly reducing the risk from unknown tools.

Step 3: On-Device Enforcement and Auditing

The combination of the gateway's policy engine and the endpoint agent ensures that rules are not just suggestions.

Connection Blocking: Bifrost Edge enforces the approval list directly on the employee's machine. If an AI agent attempts to connect to a denied MCP server, the connection is blocked before it is initiated.
Fine-Grained Access Control: For approved servers, Bifrost provides further control. Using MCP tool groups, administrators can define which specific tools are accessible to different users or teams via their assigned virtual keys.
Comprehensive Auditing: All MCP discovery and tool execution events can be logged, creating an immutable audit trail for compliance and incident response. This ensures that beyond routing and access control, Bifrost's governance and security controls are extended from the central gateway to every endpoint.

By implementing this lifecycle of discovery, central management, and endpoint enforcement, organizations can safely unlock the power of AI agents without exposing themselves to the significant security risks of ungoverned MCP servers. This centralized model turns a chaotic and invisible landscape into a managed, secure, and auditable part of the AI infrastructure. Teams looking to secure their AI agent deployments can request a Bifrost demo to see the platform's MCP governance capabilities.