How to Stop Shadow MCP at a Startup

Shadow MCP is an MCP server your company did not approve, usually on a laptop, often with a live API key in a config file. A startup stops it by naming one allowed catalog, making only owners add connectors, and treating mcp.json like a secrets file. You do not need a six-month security program to start.

OWASP tracks this as MCP09: Shadow MCP Servers: unapproved, unsupervised instances outside governance, often with default credentials or open APIs. The Model Context Protocol made servers easy to add. It did not make them easy to inventory.

Why this showed up in 2026#

Reco’s State of Agent Security 2026, as reported by SC Media (27 August 2026), found 80% of AI tools in use had no IT oversight. In a sample of 500 npm MCP servers, 50% could run shell commands, 82% could read or write local files, and 73% could make outbound network calls. Forty percent combined all three.

GitGuardian’s State of Secrets Sprawl 2026 found 24,008 unique secrets in public MCP-related config files, including 2,117 still valid (8.8%). Top types in those files: Google API keys, Postgres connection strings, Firecrawl, Perplexity, and Brave Search keys. The leak is often the setup file, not the model.

Anthropic’s own engineering note How we contain Claude (25 May 2026) says enterprises ask how to secure MCP, and that a remote tool can change behaviour after you approved it. An audited connector is not the same as audited data. A GitHub connector can still pull a poisoned README into context.

If a five-person company has Cursor plus Claude, the realistic chance that someone already added an extra server is high. The realistic chance you have a list of those servers is low.

What “stop it” looks like at a startup#

You will not scan every endpoint this week. You can do four things that close most of the hole.

ToolRouter is the hosted catalog in that table: one URL, shared seats, optional PII filter, audit log on Business. It is not a substitute for MintMCP if the RFP already demands a BAA and self-host. We say that on How companies centralize MCP.

Local npx servers remain useful for a true internal tool. They are the exception. They are not the default for “I wanted image gen in Claude.”

A 30-minute audit you can run today#

1. Ask each person which assistants they use (Claude, ChatGPT, Cursor, Grok Bot).
2. On each laptop, search for mcp.json and mcpServers. Cursor: .cursor/mcp.json and ~/.cursor/mcp.json. See How to add MCP to Cursor.
3. List every server URL or npx package. Anything not ToolRouter or an official first-party connector goes on a “justify or remove” list.
4. Rotate any key that appeared in those files. Assume it was copied.
5. Put the allowlist in writing. Manage MCP for a team has a two-line policy you can paste.

Do not shame people for installing a server. The docs for most clients teach it. Change the default, then clean up.

What ToolRouter covers in this picture#

• One connection string instead of a new npm package per job.
• No API key in the URL. The account is created on first use.
• Admins turn catalog tools off and set spend caps.
• Optional PII filter on tool traffic. Read the limits before you tell a customer it is DLP.
• Audit log on Business, so “who ran the scraper” has an answer.

What it does not cover: a malicious server someone still runs locally; prompt injection inside a page you asked to scrape; encoded secrets. Anthropic is right that the data coming *back* from a tool can still be hostile.

For the operating playbook (seats, spend, offboarding), use How to manage MCP for a team. For the Claude owner click-path, use How to add MCP on Claude Team.

Start the shared catalog on For teams.