What MCP Is
The Model Context Protocol (MCP) is the standard way AI clients connect to tools. An MCP server exposes actions, such as reading a repository, querying a database or creating a ticket, that an AI assistant can call on the user's behalf.
Claude Desktop, Claude Code, Cursor, VS Code and Windsurf all use MCP. A developer or analyst adds a server with a few lines in a configuration file, usually with their own token, and no one else is told.
Why It Needs Governing
A chat assistant can only see what someone pastes in. An AI client with MCP servers can go and get data, and act on it: read private code, export CRM records, run database queries, change files. The server runs with the user's access, and the AI decides when to call it.
- Reach. One server can expose every repository, ticket or customer record the user can see.
- Data flow. Tool calls carry data between systems, such as a customer list into a third-party service.
- Invisibility. Configuration lives in the user's profile, so nothing on the network says a server was added.
Inventory Every MCP Server
With each check-in the ProctoredAI agent reads the MCP configuration of Claude Desktop, Claude Code, Cursor, VS Code and Windsurf, and reports each server: the client it is in, whether it is a local command or a remote URL, and the command or URL. Secret-looking arguments are masked, and environment variables and headers, where tokens live, are never read. Nothing is executed.
The console lists every server per client with the devices and AI clients it was seen in, labelled from a catalog of 40 known servers with their reach (low, medium or high). The first sighting of a server raises a Shadow AI alert.
Approve, Block and Limit Remote Servers
- Block. The agent refuses the connection, and the attempt is logged with an alert.
- Approve. Calls are inspected like an AI app: every request is checked with the client's data rules before it leaves the device, so a tool call carrying a customer list or a card number is stopped, redacted or flagged by the rule. Results coming back are scanned too.
- Limit to named tools. An approved server can be held to an allowlist of tools, so an assistant can read issues but not merge code. A call to any other tool is refused and logged.
The console shows calls seen and stopped per server, and every event names the method and tool.
Local Servers
Local MCP servers run as programs on the device under the user's account, so no proxy can stop them. ProctoredAI inventories them, flags them by reach and records the decision. A local server that isn't approved has to be removed on the device, by the user or through your RMM.
Setting It Up
- Deploy the agent to developer and power-user devices first; that is where MCP servers are.
- Review the inventory after a week and approve the servers the client has accounts for.
- Block remote servers that aren't approved, and limit approved ones to the tools the work needs.
- Remove unapproved local servers through your RMM, and keep the monthly report as evidence.
MCP servers are one part of shadow AI. The MSP AI governance guide covers the full service.
Questions
Which AI clients are covered?
Claude Desktop, Claude Code, Cursor, VS Code and Windsurf.
Does ProctoredAI read MCP tokens?
No. Environment variables and headers are never read, and secret-looking command arguments are masked before anything is reported.
Can a local MCP server be blocked?
Not by the proxy, because it runs on the device. It is inventoried and flagged so it can be removed on the device.
What happens when an approved server sends sensitive data?
The tool call is checked with the client's data rules like any prompt, and blocked, redacted, warned or logged as the rule says.
Is MCP governance in the Govern plan?
Yes. MCP inventory and remote server control are part of Govern.