Who Approved That? Taking Control of Shadow MCPs and Skills

Your security team pulls a full inventory of all developer workstations. The list of approved AI platforms is documented and tightly governed.

The reality on your endpoints tells a different story.

Running alongside sanctioned models are Model Context Protocol (MCP) servers plugged into Slack, your CRM, Gmail, production databases, and cloud infrastructure. Next to them sits a growing footprint of third-party agent skills downloaded from public registries because a workflow tutorial promised immediate productivity gains.

Nobody on your security team signed off on them. The unavoidable governance question follows: Who approved that?

In most enterprises, nobody did, because nobody was asked. Connecting an MCP server takes a single line in a local configuration file. Installing an agent skill requires dropping a folder into a directory or running a single command. Neither action touches an enterprise change-control pipeline, software-approval workflow, or standard procurement checkpoint.

Enterprises spent decades learning to manage Shadow IT, followed by the initial wave of Shadow AI. Shadow MCPs and agent skills represent the next phase of that operational evolution.

The Fundamental Shift: Active Execution Environments

Traditional Shadow IT exposed data at rest or in transit:

[ Traditional Shadow SaaS ]
Employee ──► Unsanctioned Cloud App ──► Data Exposure Risk

[ Shadow MCPs & Skills ]
Employee ──► Agent Skill / MCP Pipe ──► Local Execution + Production Actions (Full User Entitlements)

Unapproved SaaS applications store data in external silos. Shadow MCP servers and agent skills operate as active execution engines. They inherit the full credentials, execution context, and local access privileges of the engineer who deployed them.

How Shadow MCPs and Skills Bypass Conventional Governance

The rapid adoption of agent tooling mirrors the operational drift that occurred when engineering teams moved from centralized APIs to open-weight models. Developers move to solve friction; security teams discover the blast radius after the fact.

Ground Reality: Threats Observed in the Wild

The exploitation of agent toolchains and execution protocols is an active threat vector documented across recent industry telemetry:

• postmark-mcp (The Trojanized Update): Researchers identified a malicious package masquerading as Postmark's email integration on npm. To establish credibility, the maintainers pushed 15 benign releases. In version 1.0.16, a single line was quietly introduced to BCC all outbound communications to an external server. Static point-in-time reviews performed on earlier builds failed to flag the update.
• ClawHavoc (Marketplace-Scale Info-Stealers): An audit of 2,857 skills hosted on ClawHub (the public repository for OpenClaw agents) revealed 341 overtly malicious packages. Disguised under ordinary utilities like youtube-summarize-pro, these skills prompted users to install fraudulent dependencies that dropped Atomic Stealer, harvesting API tokens, SSH credentials, browser sessions, and local keychains.
• ToxicSkills (Inherent Vulnerability Baseline): An assessment across nearly 4,000 public skills identified that 36.8% contained exploitable security flaws, 13.4% carried critical remote execution or exfiltration vulnerabilities, and dozens harbored weaponized payloads out of the box.
• Exposed MCP Surfaces: Internet-wide scans discovered over 1,800 MCP instances exposed directly to the public web. In validated testing, 100% of tested endpoints enumerated their full tool catalogs and programmatic capabilities to unauthenticated, external queries.

The Capability Footprint: Inherent Architectural Risk

Beyond deliberate malware, the core architecture of popular, well-intentioned skills introduces structural risk to endpoints. In a benchmark study analyzing enterprise-deployed MCP servers and skills:

• 76% of MCP servers feature high-risk system capabilities.
• 25% expose pathways for arbitrary local code execution.
• 62% of agent skills introduce privilege-granting behaviors without audit logging.

Agent Skill Capabilities Observed in Enterprise Endpoints:

[50%] Embedded Shell Commands in Instructions
      (Directs the agent to invoke local terminal commands)
[30%] Bundled Executable Scripts
      (Executes Python, Bash, or Node runtimes during workflow execution)
[13%] Automatic Permission Overrides
      (Configured via frontmatter to bypass native user confirmation prompts)
[ 6%] Unresolved External Dependencies
      (Unregistered package references vulnerable to dependency hijacking)
[ 2%] Pre-Prompt Execution Hooks
      (Runs local commands before the model parses instructions or requests consent)

Enterprise Tooling Coverage Gaps

Shadow agent architectures live within the gaps of traditional endpoint and network defense tooling:

┌────────────────────────────┬──────────────────────────────────────┬──────────────────────────────────────────────┐
│ Existing Enterprise Tool   │ What It Evaluates                    │ The Blind Spot                               │
├────────────────────────────┼──────────────────────────────────────┼──────────────────────────────────────────────┤
│ SCA (Software Composition) │ Declared package manifests (lock)    │ Markdown instructions & unstructured scripts │
│ EDR (Endpoint Detection)   │ Host processes and binary signatures │ Semantic agent intent & native JSON-RPC IPC  │
│ CASB / SWG / SASE          │ Cloud traffic & SaaS access logs     │ Local socket pipes, loopback calls, stdio    │
│ Static Security Reviews    │ State of source at time of review    │ Upstream mutations & remote runtime payloads │
└────────────────────────────┴──────────────────────────────────────┴──────────────────────────────────────────────┘

Industry frameworks are converging on this requirement. The MCP Security Specification mandates explicit command visualization and scoped approval prior to server registration. Anthropic’s Enterprise Agent Guidance dictates that skill integration must meet production software deployment rigor. Furthermore, OWASP Top 10 for Agentic Applications classifies unauthorized tool registries under ASI04: Agentic Supply Chain Risks.

Executive Playbook: Establishing Enterprise Agent Governance

Attempting an outright ban on local MCP tools and agent skills introduces the same failure mode seen with shadow cloud storage: developers route around friction.

A resilient governance posture provides engineers an approved channel while enforcing automated visibility, immutable provenance, and runtime defense.

  DEVELOPER ENVIRONMENT                 GOVERNANCE CONTROL PLANE                 EXECUTION RUNTIME
┌──────────────────────────┐         ┌──────────────────────────────┐         ┌────────────────────┐
│ • Local IDEs & CLIs      │         │ 1. Continuous Discovery      │         │ • Strict Allowlist │
│ • MCP Connectors         │───────► │ 2. Automated Capability Scan │───────► │ • Content-Pinned   │
│ • Community Skills       │         │ 3. Cryptographic Fingerprint │         │ • Runtime AI-DR    │
└──────────────────────────┘         └──────────────────────────────┘         └────────────────────┘
                                                     ▲                                   │
                                                     │         Payload Mutation          │
                                                     └──────── Or Drift Detected ────────┘
                                                               (Automatic Revocation)

1. Shift from Point-in-Time Audits to Continuous Asset Discovery

Inventory must extend beyond installed applications to cover local configuration trees, CLI agent states, and desktop client integrations. The primary baseline requirement is maintaining an automated, real-time map of:

• Active MCP server connections and transport pipes (stdio/SSE).
• Registered agent skills across managed workstations.
• Identity context: the authorizing user, target enterprise systems, and the permission envelope.

2. Implement Capability-Based Pre-Execution Vetting

Static code review cannot scale to thousands of community plugins. Platforms must automatically evaluate tool manifests for latent structural hazards prior to use:

• Scanning for embedded shell payloads, silent permission bypass flags, and hidden network calls.
• Profiling the surface area of MCP servers to verify administrative access requirements and excessive system primitives.
• Identifying unpinned dependencies susceptible to repository squatting.

3. Bind Tool Authorization to Immutable Cryptographic Hashes

Approval must be strictly bound to a cryptographic hash of the verified code and instructions rather than an arbitrary package name, GitHub repository, or URL.

• Upstream instruction modifications or dependency version bumps invalidate the signature automatically.
• The system enforces re-authorization before the agent can invoke the mutated resource.

4. Deploy Runtime AI Detection and Response (AI-DR)

Pre-deployment posture management covers static risks, but agents consuming external web data, documents, and API responses remain vulnerable to indirect prompt injection and tool manipulation.

• Contextual Behavioral Monitoring: Audit the semantic stream between the model and the host system to flag instruction hijacking attempts.
• Deterministic Runtime Guardrails: Enforce endpoint policies that terminate unauthorized subshells, block unvetted outbound IP connections, and prevent automated data exfiltration.

Close the Gap

Agentic frameworks and Model Context Protocols deliver clear productivity multipliers, ensuring continued integration by engineering teams. Long-term operational control requires answering "Who approved that?" for every connected tool, supported by continuous verification that the active endpoint runtime matches the authorized configuration.