MCP Servers, Signed and Scoped
MCP servers are the new privileged-dependency class. Your AI agents trust them with production credentials. Safeguard provides the governance layer: verified registry, capability-manifest review, scoped per-server credentials, and full audit logs of every tool invocation.
Why MCP Is npm-2014 All Over Again
Open protocol, explosive ecosystem growth, no governance layer between “someone published it” and “it has your production credentials”.
Capabilities, Not Just Code
A traditional package dependency is code. An MCP server exposes tools — with capabilities to send email, read files, query databases. The security question is not 'what does the code do?' but 'what permissions does it hand the AI?'
Execution Context Is Elevated
An MCP server wrapping your Salesforce API has your Salesforce credentials by design. A malicious server does not need to escape; it was granted the keys at install time.
Prompt Injection Becomes RCE-Adjacent
Because tool calls are triggered by LLM output, prompt injection anywhere upstream can trigger tool calls the operator never intended. Every context-window input is effectively a candidate instruction.
Stale Servers Accumulate Quietly
Engineers install servers for experiments and never uninstall them. Over months you accumulate ad-hoc tools with stale credentials. None of it is on your asset inventory.
Registry. Review. Runtime.
Verified Registry & Manifest Review
Tiered trust model — Tier 1 for official, signed, widely-used servers; Tier 2 for reviewed community servers; Tier 3 blocked in production. Capability manifests reviewed before an MCP server is allowed in the org registry.
Scoped Credentials Per Server
Purpose-built service identities per MCP server deployment. Credentials scoped to exactly the APIs the server declares needing. No more generic 'MCP runner' role with broad cloud permissions.
Invocation Audit & Drift Alerts
Every MCP tool call logged with full context: server, tool, arguments, LLM session, user. Drift from declared capability triggers alerts. Anomalous patterns (off-hours, unusual args) surface for review.
From Request To Production In A Reviewable, Auditable Path
A developer requests an MCP server be added. Safeguard automatically fetches the manifest, verifies the signature, pulls down the source for review, and surfaces any dependency, capability, or credential-scope concerns to the security reviewer. On approval, the server is added to the org registry with scoped credentials provisioned and logging enabled. Invocations flow to your SIEM. Capability drift triggers a review ticket. Stale servers expire unless re-affirmed.
Where This Bites In Real Life
Coding agents and MCP servers in production raise risks SCA was never designed to catch.
Coding Agent In A Regulated Repo
An agent has commit rights to a SOC 2 in-scope service. Block writes to production manifests, redact customer IDs in tool output, log every action with the user's identity attached.
Multi-Vendor Agent Stack
Engineering uses Claude Code, Cursor, Cline, and a couple of in-house agents. One allowlist, one capability catalogue, one audit trail — regardless of which agent made the call.
Prompt-Injection Exfiltration
Adversarial text in a connected vector store tries to trick the agent into leaking credentials. Lion runs inline on every tool response and quarantines the suspicious flow.
EU AI Act Logging
Agent activity must be auditable end-to-end with cryptographic provenance. Every tool call, every redaction, every policy decision — signed and chained.
How Safeguard Handles It
- 01
Agent Connects
The agent hits the Safeguard MCP proxy. Connection metadata — agent vendor, version, environment — is captured before any tool call.
- 02
Identity & Auth
The agent presents a scoped service identity bound to a human user. No shared bot accounts; every invocation is attributable.
- 03
Capability Scope Applied
Per-tool capability scope resolved from policy. The agent only sees the tools its role is allowed to invoke.
- 04
Tool Call Inspected
Arguments scanned for sensitive selectors (production hosts, customer IDs, secrets). Outbound payload checked against the policy bundle.
- 05
Output Scanned By Lion
Lion runs inline on the response — PII redaction, secret detection, prompt-injection signatures. The agent never sees the raw sensitive bytes.
- 06
Decision Logged With Chain-Of-Custody
Allow, deny, or transform — the decision is written to the signed audit log with a hash chain back to the previous entry.
- 07
Response Returned Or Blocked
Clean responses reach the agent; flagged responses return a structured policy error the agent can reason about.
What You See, Ship, And Report
In-Editor Approval Prompt
Sensitive tool calls surface a one-click approval prompt inside the IDE. The developer sees the agent's intent, the argument, and the policy verdict before they say yes.
Bot Account Quota & Tokens
Per-agent token usage report attached to the PR. CI checks the quota and flags when an agent is operating above its baseline.
Activity Timeline & Violations
Agent activity timeline across the org, policy-violation rate by tool, and a redacted-output counter that proves Lion is doing the inline work.
Don't Let MCP Outgrow Your Governance.
Put the registry, review process, and audit trail in place before MCP scales across engineering and business teams.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.