FollowAgents AI AGENTS DIRECTORY
Home / AI Agent Glossary / Shadow MCP
Evaluation & Safety

Shadow MCP

Also called: shadow MCP servers · unsanctioned MCP servers · MCP09

Shadow MCP is the use of Model Context Protocol servers inside an organization without the approval, registration, or monitoring of its security team.

An MCP server gives an AI agent tools and data: a database, a repository, a ticketing system, a shell. Connecting one is easy. A developer adds a few lines to a client config, pastes in a token, and the agent can act on that system. When this happens without anyone in security knowing, the result is shadow MCP.

The OWASP MCP Top 10 project lists it as MCP09:2025 – Shadow MCP Servers and describes it as unapproved or unsupervised MCP deployments that sit outside formal security governance. The risks it lists are concrete: data processed by servers nobody monitors, a wider attack surface, missed compliance obligations, unpatched or inconsistent configurations, slower incident response, and unvetted connectors entering the supply chain.

"Shadow" describes the missing oversight, not a known vulnerability. Most of these servers are set up in good faith for convenience. The problem is that nobody owns them, reviews them, or would notice when one misbehaves.

How it works

Shadow MCP usually appears in one of two ways. A person runs a local server, often a community package, and connects it to work systems with their own long-lived credentials. Or a team stands up a remote MCP endpoint for internal use that never goes through the review an ordinary internal API would get. Either way, the agent inherits whatever the server's credentials allow, and its tool calls bypass central authentication and logging.

Governance works like any shadow-IT program. OWASP's guidance includes registering and approving every MCP instance, scanning networks and cloud accounts for MCP endpoints, using hardened configuration baselines, connecting servers to the central identity provider, and adding shadow-MCP detection to incident-response playbooks.

Example

A data analyst installs a community mcp-server that queries the production warehouse and configures it with their own read-write database password. Their coding agent can now run arbitrary SQL with that password. The server is in no inventory, and its queries appear only as the analyst's normal traffic.

How it differs

Shadow MCP vs. shadow-ai: shadow AI is the broad problem of unapproved AI tools and agents at work. Shadow MCP is a narrower, higher-impact case, because an MCP server holds credentials and gives an agent the ability to act on systems, not just to receive text.

Common misconceptions

Often assumed: A shadow MCP server is a malicious server.
Actually: Most are well-intentioned convenience setups; the risk comes from missing ownership, review and monitoring, which also leaves room for a malicious or compromised server to go unnoticed.
Often assumed: Local MCP servers are safe because they run on the developer's own machine.
Actually: A local server still uses real credentials against real company systems, so where it runs does not limit what it can reach.

FAQ

What is shadow MCP?
MCP servers used inside an organization without security approval, registration or monitoring. OWASP lists this as MCP09 in its MCP Top 10.
Why are shadow MCP servers dangerous?
They give agents access to company systems through credentials and connectors nobody reviewed, outside central logging, so data exposure or misuse can go undetected.
How do you find shadow MCP servers?
Inventory and approve MCP instances, scan networks and cloud accounts for MCP endpoints, review agent client configs on managed devices, and watch for MCP-style traffic from unknown hosts.

Last checked: 2026-10-19

Related terms

Shadow AI

Shadow AI is the use of AI applications, models, or agents inside an organization without the approval, oversight, or visibility of IT and security teams.

MCP Server

An MCP server is a program that exposes tools, resources, and/or prompt templates to AI applications through the MCP protocol.

Tool Poisoning

Tool poisoning is a form of indirect prompt injection where the malicious instructions are hidden inside a tool's own metadata — its description, parameter docs, or schema — which the model ingests when it decides how to use the tool, but which the user's interface never shows.

Agent Identity

Agent identity is the practice of treating an autonomous agent as its own principal in an access-management system — with its own credentials, narrowly scoped and time-limited permissions, a delegation chain back to an authorizing human, and its own audit trail.