Shadow MCP Server
A shadow MCP server is a Model Context Protocol server that an employee connects to an AI assistant without review or registration, granting the assistant tool access that no inventory records.
Installation Takes a Line of Configuration
Connecting an MCP server means editing a config file in an AI client and restarting it. No procurement, no ticket, no admin console. A developer who wants an assistant to query a database, read Jira or run shell commands adds the server that does it, often one pulled from a public registry with no review of its code. The assistant now holds those capabilities for every conversation.
Harder to Find Than Shadow SaaS
Unsanctioned SaaS leaves a trace, since someone registered an account and traffic flows to a recognizable domain. A shadow MCP server frequently runs as a local process on the employee's own machine, talking to the AI client over standard input and output. Nothing crosses the network in a form network telemetry can read. Kovrr's work on governing AI coding agents on developer laptops addresses this category directly.
The Exposure Runs Two Ways
Outbound, the server hands an assistant access to whatever it wraps, which may include production credentials sitting in the developer's environment. Inbound, the server description and tool definitions enter the model's context, where a malicious or compromised server can rewrite how the assistant behaves, the mechanism covered under tool poisoning. A server installed from a registry can also change its definitions after installation, which the entry on MCP rug pull attacks describes.
Finding Them Requires Endpoint Position
Discovery depends on reading the client configuration on the device and observing local process behavior, since neither the network nor the identity provider holds the evidence. Shadow AI detection covers the broader category, and an MCP gateway only accounts for servers that were routed through it in the first place.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
