MCP Server Governance

The Model Context Protocol (MCP) enables AI agents to interact with external tools, data sources, and services through a standardized interface. While MCP dramatically expands what agents can do, it also expands the attack surface — every MCP server is a potential vector for data exfiltration, unauthorized actions, or privilege escalation. VeraID provides centralized governance for MCP servers, giving you visibility and control over which servers your agents can access and what capabilities those servers expose.

Why Govern MCP Servers

MCP servers are fundamentally different from traditional API integrations:

Dynamic discovery — Agents can discover and connect to MCP servers at runtime, without explicit configuration
Broad capabilities — A single MCP server can expose tools (actions), resources (data), and prompts (instructions), any of which can be malicious
Trust ambiguity — There is no built-in mechanism to verify that an MCP server does what it claims, or that it will not exfiltrate data passed to it
Supply chain risk — MCP servers are often third-party packages with their own dependencies and update cycles

Without governance, an agent with MCP access can connect to any server, use any tool, and pass any data — with no visibility or control from your security team.

MCP Server Registration

All MCP servers must be registered in VeraID before agents can connect to them. Registration creates a central inventory and triggers the capability scanning process.

Register a Server

curl -X POST https://app.veraid.io/api/v1/mcp/servers \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "database-readonly",
    "description": "Read-only access to the analytics database",
    "endpoint": "https://mcp.internal.example.com/database-ro",
    "transport": "streamable-http",
    "owner": "user:alice@example.com",
    "tags": ["database", "analytics", "read-only"]
  }'

Auto-Discovery

VeraID can automatically discover MCP servers that agents attempt to connect to. When an agent references an unregistered server, VeraID intercepts the connection, registers the server with DISCOVERED status, and blocks access until the server is reviewed and approved.

{
  "id": "mcp_3f7a8b2c-9d4e-5f6a-b1c2-d3e4f5a6b7c8",
  "name": "unknown-mcp-server",
  "status": "DISCOVERED",
  "endpoint": "https://mcp.external.example.com/tools",
  "discoveredBy": "idt_9c3a8b7e-4f21-4d6a-b8e1-a2c5d9f07e3b",
  "discoveredAt": "2026-03-19T14:30:00Z",
  "trustLevel": "UNTRUSTED"
}

Capability Scanning

When an MCP server is registered — whether manually or through auto-discovery — VeraID scans its declared capabilities across three dimensions.

Tools

Tools are executable actions that an MCP server exposes. VeraID catalogs each tool with its name, description, input schema, and assessed risk level.

{
  "tools": [
    {
      "name": "query_database",
      "description": "Execute a read-only SQL query against the analytics database",
      "inputSchema": {
        "type": "object",
        "properties": {
          "query": { "type": "string" },
          "limit": { "type": "integer", "default": 100 }
        }
      },
      "riskAssessment": "medium",
      "reason": "Executes arbitrary SQL; read-only but could expose sensitive data"
    },
    {
      "name": "export_csv",
      "description": "Export query results as a CSV file",
      "inputSchema": {
        "type": "object",
        "properties": {
          "queryId": { "type": "string" },
          "format": { "type": "string", "enum": ["csv", "json"] }
        }
      },
      "riskAssessment": "high",
      "reason": "Data export capability; potential for bulk data exfiltration"
    }
  ]
}

Resources

Resources are data sources that an MCP server provides access to. VeraID scans for the type, sensitivity, and access patterns of each resource.

{
  "resources": [
    {
      "uri": "db://analytics/customers",
      "name": "Customer Analytics",
      "mimeType": "application/json",
      "sensitivity": "high",
      "reason": "Contains customer behavioral data and segmentation"
    }
  ]
}

Prompts

Prompts are predefined instruction templates that an MCP server provides to agents. VeraID scans prompt templates for potential injection patterns and flags suspicious content.

{
  "prompts": [
    {
      "name": "analyze_trends",
      "description": "Analyze trends in the provided dataset",
      "injectionRisk": "low",
      "arguments": [
        { "name": "dataset", "required": true },
        { "name": "timeRange", "required": false }
      ]
    }
  ]
}

Trust Levels

Every MCP server is assigned a trust level that determines the degree of scrutiny applied to its operations. Trust levels are progressive — a server must earn trust through review and observation.

Trust Level	Description	Agent Access	Monitoring
`UNTRUSTED`	Server has not been reviewed. Default for auto-discovered servers.	Blocked — No agent can connect	Full logging of discovery events
`UNREVIEWED`	Server is registered but has not completed security review.	Blocked — No agent can connect	Capability scan results available
`REVIEWED`	Server has been reviewed and approved with conditions.	Restricted — Only approved agents, with enhanced monitoring	All requests and responses logged
`TRUSTED`	Server has passed review and demonstrated reliable behavior over time.	Open — Any agent with matching policy can connect	Standard audit logging

Promoting Trust Level

# Promote from UNREVIEWED to REVIEWED after security review
curl -X PATCH https://app.veraid.io/api/v1/mcp/servers/{serverId} \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "trustLevel": "REVIEWED",
    "reviewNotes": "Reviewed by security team. Read-only database access confirmed. No write tools. Approved for analytics agents.",
    "reviewedBy": "user:security-lead@example.com"
  }'

Status Lifecycle

MCP servers follow a defined status lifecycle independent of their trust level. Status reflects operational state, while trust level reflects security posture.

┌────────────┐    register    ┌──────────┐    review     ┌──────────┐    activate   ┌──────────┐
│ DISCOVERED │──────────────►│ PENDING  │─────────────►│ APPROVED │────────────►│  ACTIVE  │
└────────────┘               └──────────┘              └──────────┘             └────┬─────┘
                                   │                                                 │
                                   │  reject                              deprecate  │  revoke
                                   ▼                                         │       │
                              ┌──────────┐                                   ▼       ▼
                              │ REJECTED │                           ┌────────────┐ ┌─────────┐
                              └──────────┘                           │DEPRECATED  │ │ REVOKED │
                                                                     └────────────┘ └─────────┘

Status	Description
`DISCOVERED`	Auto-discovered by an agent connection attempt. Not yet registered or reviewed.
`PENDING`	Registered and awaiting security review. Capability scan in progress or complete.
`APPROVED`	Security review passed. Server is approved but not yet activated for agent use.
`ACTIVE`	Server is live and available for agent connections according to its trust level and policies.
`DEPRECATED`	Server is being phased out. Existing connections are maintained but new connections are blocked.
`REVOKED`	Server access is permanently revoked. All agent connections are immediately terminated.
`REJECTED`	Security review failed. Server is blocked and cannot be activated without re-review.

Per-Agent Access Control

MCP server access is governed at the agent identity level. Each agent can be configured with an allowlist or denylist of MCP servers it can connect to.

Allowlist Mode

Only explicitly listed MCP servers are accessible. This is the default and recommended mode.

{
  "agentConfig": {
    "mcpPolicy": {
      "mode": "allowlist",
      "servers": [
        {
          "serverId": "mcp_3f7a8b2c-9d4e-5f6a-b1c2-d3e4f5a6b7c8",
          "allowedTools": ["query_database"],
          "deniedTools": ["export_csv"],
          "maxCallsPerHour": 100
        },
        {
          "serverId": "mcp_8a9b0c1d-2e3f-4a5b-6c7d-8e9f0a1b2c3d",
          "allowedTools": ["*"],
          "deniedTools": [],
          "maxCallsPerHour": 50
        }
      ]
    }
  }
}

Denylist Mode

All ACTIVE servers are accessible except those explicitly denied. Use this mode only for agents that need broad MCP access, such as development or testing agents.

{
  "agentConfig": {
    "mcpPolicy": {
      "mode": "denylist",
      "deniedServers": [
        "mcp_production-database",
        "mcp_payment-gateway"
      ]
    }
  }
}

Approve and Revoke MCP Servers

Approve a Server for an Agent

curl -X POST https://app.veraid.io/api/v1/identities/{agentId}/mcp/servers \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "serverId": "mcp_3f7a8b2c-9d4e-5f6a-b1c2-d3e4f5a6b7c8",
    "allowedTools": ["query_database"],
    "deniedTools": ["export_csv"],
    "maxCallsPerHour": 100,
    "justification": "Agent requires read-only database access for analytics reporting"
  }'

Revoke a Server from an Agent

curl -X DELETE https://app.veraid.io/api/v1/identities/{agentId}/mcp/servers/{serverId} \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "reason": "Agent no longer requires database access",
    "terminateActiveSessions": true
  }'

List Agent MCP Access

curl https://app.veraid.io/api/v1/identities/{agentId}/mcp/servers \
  -H "Authorization: Bearer $API_KEY"

{
  "servers": [
    {
      "serverId": "mcp_3f7a8b2c-9d4e-5f6a-b1c2-d3e4f5a6b7c8",
      "name": "database-readonly",
      "trustLevel": "REVIEWED",
      "status": "ACTIVE",
      "allowedTools": ["query_database"],
      "deniedTools": ["export_csv"],
      "callsLastHour": 23,
      "maxCallsPerHour": 100,
      "lastUsedAt": "2026-03-19T14:28:00Z"
    }
  ]
}

What’s Next

AI Agent Overview — Understand the full agent identity model
Approval Workflows — Configure human review for MCP server approvals
Prompt Injection Detection — Scan MCP prompt templates for injection patterns