February 4, 2026
MCP Is Where AI Risk Becomes Real
In this post we're talking about the fact that the agentic and MCP layer is a blindspot to security teams and how to avoid it.
Read MoreAI security posture management for AI agents
AI security posture management (AI-SPM) is knowing which AI is in use across your company, what it is made of and whose account it runs under, measuring the risk in all of it, and governing what is allowed.
Autonomous applies it to AI agents and everything they load. The AI Security Posture pillar of its engine discovers every AI app, MCP server, skill and package on your endpoints, grades your posture from A to F, scans what agents connect to, and lets you allow, restrict or block each of them, watching before it enforces.
Why AI agents need posture management
Most security teams can't say which AI agents their developers run. The ecosystem around them moves faster still: more than 12,900 MCP servers are indexed publicly and over 91,000 skills, and roughly one in three companies builds MCP servers of its own.
The risk is in what an agent loads
An agent's reach comes from its MCP servers, skills, extensions and the packages it installs. Each is code from somewhere, and each can change after someone approved it.
And whose account it runs under
The same app signed in to a personal account sends your code and data to an organization you don't control. From the outside, the two look identical.
Cloud security posture tools don't see it
CSPM reads cloud configuration and DSPM reads data stores. Neither looks inside a developer's laptop, where the agents, their configuration files and their credentials live.
How it works
Discover
The endpoint agent finds every AI app on every machine, the workspaces people sign in to, and the skills, MCP servers, commands, extensions and packages the apps load, rolled up to the person who uses them.
Assess
Each asset is rated for risk, MCP servers and skills are scanned for malicious code, prompt injection and embedded secrets, and the whole fleet gets one grade, A to F, across six risk areas.
Govern
Allow, restrict or block apps, models, organization IDs, MCP servers, single tools and skills. Every policy can run in monitor first, so you see what it would block before it blocks anything.
Your posture, layer by layer
Posture is one grade made of everything below it. Each layer of the inventory carries its own risk, and all of it rolls up to a person, so every finding has a name attached.
Dana, platform engineer
Everything below rolls up to her
Layer 1 · Endpoint
Counts toward Fleet- MacBook Proendpoint agent up to datelow
Layer 2 · AI apps and their accounts
Counts toward AI Apps- Claude Codesigned in to Acme's workspace (corporate)low
- Cursorsigned in to Acme's team (corporate)low
- ChatGPT Desktopsigned in to a personal accountpersonal
Layer 3 · Assets: MCP servers, skills, extensions
Counts toward Inventory · Secrets- db-backup skillan access key written into itcritical
- Database MCP servera password in its configurationhigh
- Issue tracker MCP serverscanned, officiallow
- code-review skillnew version, not reviewed yetmedium
Layer 4 · Packages its projects install
Counts toward Packages- An npm packagea confirmed malicious versionmalicious
- Three PyPI packagesknown vulnerabilitiesmedium
Security posture
C68 / 100
Graded A to F, from every open finding
- Fleetfrom Layer 1grade A
- AI Appsfrom Layer 2grade C
- Inventoryfrom Layer 3grade D
- Secretsfrom Layer 3grade D
- Packagesfrom Layer 4grade D
- Runtime Protectionfrom guardrailsgrade B
Resolve or dismiss a finding and its area, and the grade, recover.
The grade drops as findings open and recovers as your team resolves them, or dismisses what isn't a risk. Acknowledging a finding doesn't recover the score: an accepted risk is still a risk.
AI inventory
Discovery is organized in layers: endpoints run AI apps, apps host assets, and projects have dependencies. AI discovery that stops at the app name misses where the risk is.
AI apps
More than 50 AI agents and apps, from Cursor and Claude Code to ChatGPT Desktop, with who uses each, how active it is and which workspace each person signs in to.
Corporate or personal accounts
Autonomous reads the organization ID AI apps sign in to. Name your company's workspaces, and personal accounts and unknown workspaces stand out.
Skills, MCP servers and extensions
MCP servers, skills, commands, hooks, rules, extensions and models, each with what it can do, its risk, and any credential it embeds. A new version of an asset is a new item to approve.
Packages
Agents install and update packages constantly, so the packages your projects install are part of AI risk: each with its worst known advisory, confirmed malicious versions flagged, and who is exposed.
All of it rolls up per person: open someone to see their machines, their AI apps and accounts, what those apps load and what it puts at risk.
MCP and skills scanner
Scan an MCP server before an agent goes near it. Paste a GitHub or GitLab repository, a PyPI or npm package, or a Docker image, and get a scored report.
- A security score out of 10 and a verdict, Safe or Caution, from static and dependency analysis.
- The report: vulnerabilities by severity, malicious code, potential data exposure, the external endpoints it calls and its dependencies.
- Skills in a repository are scanned for prompt injection, embedded secrets and other risks.
- Private repositories through your source-control integration, their reports private to your organization.
- The same scan rates what discovery finds on your endpoints, and a policy can block anything rated high or critical.
Why scan at all: the first malicious MCP server found in the wild was a working email server with one extra line, copying every email it sent to an attacker. Approved Once. Trusted Forever.
Policy management
Policies decide what may exist and run on your endpoints; guardrails, a separate layer, judge what an agent does at runtime. Each policy area enforces on its own, so one can block while another only monitors.
| You block | What happens |
|---|---|
| An AI app | Its process is closed, with a notification naming the policy. |
| A personal or unknown account | Prompts under it are held at submit on agents with real-time hooks; other accounts keep working. |
| An MCP server, or one of its tools | The tool call is dropped mid-workflow; the session carries on. |
| A skill, command, agent or rule | It is quarantined, so the agent no longer sees or loads it. |
| A model | Calls to it are blocked in apps that name their model, such as Cursor and Claude. |
| An AI web app | The browser extension stops the visit, by app, tag or domain. |
- Monitor first: the same evaluation runs and each outcome is recorded as would block, until you choose to enforce.
- Allowlist or blocklist: set the default for anything unlisted, so only the workspaces, servers or skills you name can run.
- Scoped to teams through groups synced from your identity provider or device manager, so a pilot group can enforce first.
What we see on real endpoints
Our research team went over more than 100,000 real AI agent sessions on enterprise endpoints. Some of what the agents did shows why the inventory has to reach past the app name.
- enterprise agent sessions studied
- 100k+
- with actions nobody asked for
- 30,232
- read from an unclassified SaaS source
- 8,301
- touched regulated data
- 4,420
Source: The Hidden Security Risks in 100k Enterprise AI Sessions
“Thanks to Autonomous we now have full visibility into Shadow AI and our software supply chain on 4,000 endpoints.”
Frequently asked questions
What is AI security posture management (AI-SPM)?
It is the practice of finding the AI in use across an organization, measuring its risk and governing it: which AI apps and models run, what they connect to, which accounts they use, and what is allowed. For AI agents that means the MCP servers, skills and packages they load too, summed up as one posture you can report.
How is AI-SPM different from CSPM or DSPM?
Cloud security posture management checks cloud configuration, and data security posture management finds sensitive data in your stores. AI-SPM inventories the AI itself: the agents on laptops, the accounts they sign in under, the tools and code they load. It complements them; it doesn't replace them.
Is this an AI governance platform?
For AI agents, yes: it decides which AI apps, models, accounts, MCP servers and skills may be used, enforces it on every endpoint and reports one posture to leadership.
Can it tell personal accounts from corporate ones?
Yes. Autonomous reads the organization ID an AI app signs in to. Mark your company's workspaces as allowed and block every other account: on agents with real-time hooks the prompt is held, so the corporate account in the same app keeps working; other apps are closed, with a notice saying why.
Can we scan an MCP server before anyone installs it?
Yes. Paste its repository, package or image into the scanner for a scored report, and add a policy for it before it is ever discovered on a machine. Try it on any public MCP server or skill with the free scanner.
Does blocking a skill or an MCP tool break the agent?
The agent keeps running. A blocked skill is quarantined, so the agent no longer loads it, and a blocked MCP tool call fails while the rest of the session continues. Run the policy in monitor first to see what it would block.
How is this different from Shadow AI discovery?
Finding the AI apps nobody approved is the first layer of it. Posture management goes on to what those apps load, how risky it is and what is allowed. Start with Shadow AI.
How long does it take to get running?
About 10 minutes to integrate. The endpoint agent runs on macOS, Windows, Linux and containers, in the cloud too: install it with one command, or silently through your MDM (Microsoft Intune, Jamf Pro, Iru (Kandji), JumpCloud, Mosyle, Fleet or any other). Its first scan inventories a machine's AI agents within a few minutes.
Will it disrupt our developers or block their work?
Not unless you choose to. Every new policy and guardrail starts off or in monitor mode, where activity is evaluated and logged but nothing is blocked. You move a policy to enforce when its findings look right, for a pilot group first.
Related posts
January 27, 2026
Approved Once. Trusted Forever. That’s the Problem.
In this post, we discuss one of the most critical issues surrounding MCP servers: their role as an additional supply-chain attack vector.
Read More
May 13, 2026
The Agentic Ecosystems Is Booming
From this article, you learn how the explosive growth of AI agents, MCP servers, plugins, and skills is creating an entirely new cybersecurity challenge for enterprises. It explains why MCP adoption is accelerating across organizations, why traditional endpoint security tools are no longer enough, and how risks such as malicious open-source packages, exposed API keys, and prompt injection attacks are expanding the enterprise attack surface. The article also introduces Autonomous Security, a new enterprise tool that provides visibility, guardrails, and real-time protection for AI agents without slowing productivity, helping organizations securely scale AI adoption while maintaining governance and control.
Read MoreSee your own AI posture
Find every AI agent on your endpoints, what it loads and whose account it runs under, in about 10 minutes.
Book a demo