Agents and MCP servers arrive faster than review can reach them. Discover, score, and block them fleet-wide in minutes.
An AI agent
An MCP server
A skill
An AI agent is an AI system that does not only answer, it acts. It makes tool calls, reads and writes to systems, and continues through several steps without a person approving each one. The security consequence follows directly. An agent's reach is not its prompt. Its reach is the set of tools it can call and the identity it calls them as.
An MCP server is a component that exposes tools and data to an AI client through the Model Context Protocol. It is the connective tissue between a model and the things a model can touch. A filesystem MCP server exposes files. A database MCP server exposes queries. That is exactly why an unreviewed one is a problem. By design, it is a bridge into something.
A skill is a packaged capability an agent loads at runtime. It is code that executes with the agent's privileges, obtained the way packages are usually obtained, which is to say quickly and from a registry.
More than 21,000 MCP servers are published in the official Model Context Protocol Registry as of August 2026. That counts published servers, not enterprise deployments, and one organization can publish many, so read it as a floor on the size of the ecosystem rather than as a deployment figure.
Model Context Protocol Registry, enumerated August 2026
They fail in different ways and they are found by different means, which is why treating them as one category is how they get missed. Each row names a surface, then names where AIBound sits on it.
1
A single unvetted skill or MCP server can exfiltrate data, escalate privileges, or pivot into production systems. This is not hypothetical. JFrog reported tracking malicious AI agent skills for the first time in 2026, identifying 969 that carried high-impact payloads, alongside 495 malicious AI models on Hugging Face and 56 malicious extensions on OpenVSX.
Where AIBound sits
Skills are classified for risk at discovery, before anyone has to read the code.
JFrog 2026 Software Supply Chain Security State of the Union
2
SAST, DAST, and EDR were not designed for autonomous agents making tool calls with inherited identities. The action that matters happens at runtime, between the model and the tool, and that is a layer none of those three watches. A code scanner can tell you the agent is well written. It cannot tell you the agent just read a customer database because a skill asked it to.
Where AIBound sits
Trust and risk are scored per agent and per MCP server, rather than per repository.
3
The agent runs as something. Whatever that something can reach, the agent can reach, which makes the entitlement the real blast radius rather than the model. This is the surface most likely to be assumed handled by the IAM team, and it carries the widest measured blind spot of the four: 92 percent of organizations lack full visibility into AI identities, in a survey of 235 security leaders at enterprises of 5,000 employees or more.
Where AIBound sits
The identity an agent inherits is mapped on the identity graph, covered on the identities and connections page.
Cybersecurity Insiders 2026 CISO AI Risk Report, sponsored by Saviynt
4
Developers install new agents and MCP tools in minutes. Security teams find out weeks later, if at all. In JFrog's 2026 survey of 1,508 IT professionals, 18 percent of organizations had zero governance over the integrated development environments or Model Context Protocol servers sitting inside their developers' workflows, while 97 percent of the same respondents said they had certified model governance. The distance between those two numbers is the problem in one line.
Where AIBound sits
Discovery reads telemetry your existing tools already produce, so an unregistered server does not have to be declared by the team that installed it.
JFrog 2026 Software Supply Chain Security State of the Union
External evidence
Agent adoption is earlier than the discourse suggests, and that is an argument for acting now rather than an argument against it. In McKinsey's 2025 survey of 1,993 participants across 105 nations, 23 percent of respondents reported their organizations were scaling an agentic AI system somewhere in the enterprise and a further 39 percent had begun experimenting, but in any given business function no more than 10 percent said they were scaling agents. Netskope's telemetry puts 5.5 percent of organizations running agents built on popular AI agent frameworks on premises. Posture is being set now, while the estate is still small enough to govern.
McKinsey and Company, The State of AI in 2025. Netskope Cloud and Threat Report, Shadow AI and Agentic AI, 2025
FORECAST. NOT A MEASUREMENT.
Gartner predicts that by 2028, 25 percent of all enterprise generative AI applications will experience at least five minor security incidents per year, up from 9 percent in 2025. In the same release Gartner names the protocol directly: "As organizations continue to build and integrate agentic AI applications using technologies such as Model Context Protocol (MCP), new attack vectors and immature security practices will significantly elevate risk exposure."
Gartner, April 2026, prediction
AIBound catalogs every agent, MCP server, and skill in use, scores each on trust and risk, and blocks compromised tools fleet-wide in minutes.
| Agent / MCP | Users | Trust | Action |
|---|---|---|---|
| OpenClaw MCP | 47 | F | Blocked |
| Cursor Agent | 312 | B | Approved |
| Custom RAG bot | 18 | D | Under Review |
| FS-Read MCP | 9 | F | Blocked |
| Claude Desktop | 128 | A | Approved |
What comes out of it is a set of artifacts rather than a dashboard: an inventory of every agent, a map of every MCP server, a trust score per resource, a risk classification per skill, and a log of every tool that was blocked. The last one matters more than it looks. It is the record you hand over when someone asks what you did about it, and it is the only one of the five that is evidence rather than inventory.
MCP security is the practice of discovering, evaluating, and controlling the Model Context Protocol servers that expose tools and data to AI clients, together with the agents and skills that call them. It matters because an MCP server is by design a bridge from a model into files, databases, or services, so an unreviewed server is an unreviewed path into those systems. More than 21,000 MCP servers are published in the official MCP Registry as of August 2026.
An MCP server is a component that exposes tools and data to an AI client through the Model Context Protocol, so a model can read, query, or act rather than only receive text. The difference from a normal API integration is who decides to call it. An integration is invoked by code a person wrote and a reviewer approved. An MCP tool is invoked by a model at runtime, in response to input that reviewer never saw.
Because an agent acts. A chat application receives what a person chooses to paste into it, while an agent makes its own calls to systems using an identity it inherited, often with broader entitlements than the task required. That moves the security question away from what was typed and toward what the agent is permitted to reach, which is why scanning source code or filtering prompts does not cover it.
Discovery reads the telemetry your existing security tools already produce across endpoint, browser, network, and cloud, and builds a catalog of every agent, MCP server, and skill in use, so nothing has to be declared by the team that installed it. That is the point. In JFrog's 2026 survey, 18 percent of organizations had zero governance over the IDEs or MCP servers inside their developers' workflows, so the unregistered population is the one that matters.
Fleet-wide in minutes. The block runs through the endpoint, network, and identity controls you already operate rather than through anything newly installed, so the same action reaches every endpoint the tool is running on and not only the one that reported it. AIBound states that enforcement actions are explicit and controlled by your team, so this is a decision your operators take rather than one taken for them.
An unvetted MCP server was live across 47 endpoints before we saw it. AIBound scored it, flagged it, and blocked it the same afternoon.
Get real-time visibility and control over every agent and MCP server in your fleet.