ZetrixwebWhy it needs governing now
The Model Context Protocol, introduced by Anthropic, has become a common way for AI applications to connect to tools and data. Reports say it was donated to the Linux Foundation's Agentic AI Foundation, co-founded with other major AI companies, with support from large cloud and software vendors, and that adoption has been rapid. One figure cited in secondary coverage is about 97 million monthly SDK downloads in March 2026, which should be verified against the primary release.
Commentary also consistently flags authentication and fine-grained permissions as the biggest enterprise gap, with improvements on the roadmap but still evolving. Rapid adoption with immature authorization is exactly the combination security teams worry about.
A governance baseline
Start with an inventory and an approved-server list. Know which MCP servers are running, who owns them, what tools they expose, and what data they reach, and require review before a new one is connected to anything that matters. Treat third-party servers as software supply chain: pin versions, review code or vendors, and run untrusted ones in a sandbox.
Insist on per-user authorization where possible, so an agent acts with the permissions of the person it serves rather than a broad shared service account. Separate read tools from write tools, and require human approval for actions that send, modify, pay, or delete.
| Control | Purpose | Example |
|---|---|---|
| Approved server list | Stop shadow integrations | Registry with owners and review dates |
| Least privilege | Limit blast radius | Scoped, per-user tokens |
| Read/write separation | Make risky actions visible | Write tools off by default |
| Approval gates | Prevent irreversible mistakes | Human sign-off before payments or sends |
| Logging | Reconstruct what happened | Tool call records with identity |
Defend against manipulated inputs
Tool results and retrieved documents are untrusted input. A web page or document returned by a tool can contain instructions aimed at the agent. Validate and constrain what tools return, limit what an agent can do after reading untrusted content, and test with injected instructions as part of your release process.
Our article on Skills and MCP explains how policy and access fit together, and the Singapore security guidance on agentic systems provides a useful threat vocabulary.
Rolling out agents connected to real systems? Talk to us about an MCP governance baseline.
Key takeaways
- MCP adoption is fast and authorization maturity is reported as the main enterprise gap, so governance must keep pace.
- Keep an approved-server list and treat third-party servers as supply chain.
- Use per-user, least-privilege authorization, separate reads from writes, and gate write actions.
- Treat tool results as untrusted input and test with injected instructions.