Govern the MCP servers your agents use
Inventory every server, approve the ones in use, hold the rest.
Every MCP call resolves an endpoint. Securd sees each one and lets you approve, block or hold it.
| Timestamp | Action | Site | Query Name | Source IP | Reason |
|---|---|---|---|---|---|
| 2026-09-15 09:14:02 | accept | mcp-hosts | api.githubcopilot.com | 10.40.9.4 | allow list |
| 2026-09-15 09:14:02 | accept | mcp-hosts | api.github.com | 10.40.9.4 | allow list |
| 2026-09-15 09:14:05 | accept | mcp-hosts | slack.com | 10.40.9.4 | allow list |
| 2026-09-15 09:14:40 | greywall | mcp-hosts | mcp.tools-mirror.dev | 10.40.9.4 | first seen, held 72h |
| 2026-09-15 09:15:12 | greywall | support-agent | mcp.tools-mirror.dev | 10.40.5.21 | first seen, held 72h |
MCP servers are hostnames with credentials behind them
An MCP server holds OAuth tokens, API keys and write access to production systems, and makes outbound calls on behalf of every agent that uses it. Tool descriptions can be altered upstream. New servers appear whenever a team adds an integration. Agent framework configs are per agent, so no one has the whole list.
Shared policy, shared blast radius
If an agent and its MCP server resolve under one policy, an approval for one extends to the other.
Poisoned descriptions redirect traffic
A tool description can point the agent at a different host. The resolver does not read descriptions; it reads names.
No inventory exists
The list of MCP servers in use lives in dozens of config files. The resolver sees all of them the first time they are called.
Two policies, one inventory
Give MCP hosts their own policy
Run MCP servers in their own namespace, VM or container bound to an mcp-hosts policy. On the agent policy, approve only the server hostname.
Import the templates
Vendor-documented hostnames for the GitHub, Slack and Google Workspace MCP servers are in the scope templates. Import them, then run Learn Only.
Hold what is new
Set Greywall Mode to Enforce on both policies. A new server an agent was told to use is held on the agent policy; a new API the server reaches is held on the host policy.
MCP governance controls
MCP server inventory
Every server hostname an agent resolves, by agent, by environment, with first-seen timestamps and query counts.
Approval per policy
Approve the hosted GitHub server for the coding agent and not for the support agent. Approvals are list entries with a source.
Separate host policy
The destinations an MCP server reaches are governed by the host policy, not by the agents that call it.
Unapproved server events
A first-seen server is a Greywall event. Forward it to Slack or PagerDuty through the threat.detected and list.updated webhooks.
Change log
Who approved which server, when, and what was published. Rollback to any previous publish.
Environment policies
Strict production policies with long holds, permissive development policies with short ones. Same servers, different scope.
The MCP host policy
Deny by default, a 72 hour hold, and only the vendor-documented API hosts the servers need. The agent policy carries one entry for the MCP host and nothing the host reaches.
- api.githubcopilot.com
- api.github.com
- slack.com
- api.slack.com
- gmail.googleapis.com
Questions teams ask
Does Securd inspect MCP traffic?
No. Securd does not inspect TLS or read tool descriptions. It governs which hostnames each policy may resolve, which is where every MCP call begins.
What about stdio MCP servers on the agent host?
They resolve through the agent host resolver. Give the host that serves tools its own policy where possible; the developer library has the pattern.
Hosted MCP servers from vendors?
They are hostnames. Approve them on the agent policy from the scope templates and hold everything else.
Inventory your MCP servers this week
One policy on the host that serves tools, Learn Only, and the list is on the screen by Friday.