MCP SECURITY

Noma discovers every MCP server across your organization: which servers are installed, which agents they connect to, which tools they expose, and how they're configured. Shadow MCP servers that employees installed without approval are surfaced alongside sanctioned ones, so security teams see the full picture.

Each MCP server is assessed for AI-specific supply chain risks that code scanners don't cover: unpinned versions that auto-download the latest package on every invocation (rug pull exposure), excessive tool permissions (root or sudo access), low-trust packages with minimal community adoption, known vulnerabilities, and secrets exposure. Noma flags toxic combinations where multiple risks compound, like a low-health package with unpinned versions connected to production systems.

Define which MCP servers are approved, which require review, and which are blocked. Policies are scoped by server, by individual tool, and by user group. An approved MCP server doesn't mean every tool it exposes is approved: Noma lets you allow the server but disable specific tools for certain agents or users. When someone connects to an unapproved server, it gets flagged or blocked before any data flows.

MCP-specific attacks happen at runtime, inside tool responses that static scanners never see. A compromised server embeds instructions in its responses that hijack agent behavior, redirect tool calls, or exfiltrate data through the agent's own actions. Noma monitors tool call responses in real time and detects embedded prompt injection, exfiltration patterns, and cross-server shadowing before the agent acts on them.