MCP Shadow IT: your team is already connecting servers nobody vetted
Every wave of shadow IT has the same shape: a tool that is useful, free to start, and does not need anyone's permission. SaaS took a credit card. Browser extensions took two clicks. MCP servers take a URL pasted into a config file, and the assistant on the other end already has the employee's context loaded.
Why this spreads faster than the last one
There is no procurement step, no install, no admin rights, and frequently no sign-in at all. The friction that used to give security teams a chance to notice simply is not there. And unlike a rogue SaaS account, an MCP server is not a silo off to the side — it is wired into the assistant that is already reading the work.
What actually goes wrong
- The server sees whatever the model passes it, and the model is not careful about what is relevant.
- Tool descriptions are instructions the model reads, which makes every third-party server a prompt-injection surface.
- There is usually no audit trail on the company side — you learn what happened from the vendor, if at all.
- Credentials get handed to a party nobody assessed.
- A server can change what it does after you approved it, and nothing tells you.
Questions worth asking before a server is allowed
- Who operates it, and is that a company or a weekend project?
- Does it implement OAuth, and can you revoke one person without revoking everyone?
- What does it log, and can you get those logs?
- How would you find out if its tools changed?
The fix is usually supply, not prohibition
People connect random servers because they need something they cannot get otherwise. Blocking the category buys a few weeks. Publishing one sanctioned server that does the lookups they were reaching for — invoices, stock, ticket status, whatever your team keeps asking each other — removes the reason. That is a weekend of work on a platform where tools and knowledge are workspace-level and the endpoint is behind your own sign-in.