What does it hold?
A server declared with a token in its environment hands that token to anything that can steer the agent.
Holistic AI EndLayer / MCP security
MCP security.
MCP security.
See what every agent was given.
Find every MCP server declared for Claude Code, Cursor, Codex and the other agents on enrolled devices: where it runs, whether it holds a credential, and which agents load it. Then allow it, block it, or remove it from every configuration that declares it.
From a line in a config file to a decision
01 / Declared on the device
~/.claude.jsonClaude Code, user-wide.cursor/mcp.jsonCursor, in a project.vscode/mcp.jsonVS Code, in a project.mcp.jsonShipped in a repository03 / A record you can review
● High risk
MCP server: postgres
- Runs
- Locally, as a stdio command
- Credential
- Holds one: the variable name, never the value
- Loaded by
- Claude Code, Codex, Cursor
- Reach
- 5 enrolled devices
Next decision
Keep it on the permitted hosts, or block it and remove it from every configuration.
Illustrative recordDeclared → Graded → Removed
A new way inEach MCP server is a door.
Each MCP server is a door.
Most were never reviewed.
What is MCP security?
The Model Context Protocol (MCP) lets an AI agent call tools: a database, a repository, a mailbox, a browser. Adding a server takes one line in a configuration file, so developers add them the way they add packages, and nobody else hears about it.
MCP security is knowing which servers your agents were given, what each one could reach and what it holds, and deciding which ones stay. An agent that loads a server acts with that server's access, whatever instructions reach it.
Where does it run?
A server that runs somewhere else is a channel off the device that no network review saw being added.
Who wrote it?
A local server started from a registry package runs whatever that package's next version contains.
What EndLayer reads
Every declaration, on every device.
The Layer 1 Agent reads MCP declarations from the tools' own configuration. It never connects to a server, so reading one can never call it.
Every place a server is declared
User-wide configuration for Claude Code, Claude Desktop, Cursor, VS Code, Codex, OpenCode and Gemini, and project files: .mcp.json, .cursor/mcp.json and .vscode/mcp.json.
Transport, host and package
Whether the server runs locally as a command or remotely at a host, and which package a local one is started from.
Credential-bearing servers
A declaration whose environment carries a credential-shaped variable is marked as holding a credential. The variable name is the evidence; the value is never read.
Risk tier and fleet reach
Each server gets a High, Medium, Low or Unknown tier from what it can reach, and a count of the machines and agents that load it.
A declaration describes what an agent could reach, not proof that a tool was called. Devices that are not enrolled stay visible as gaps.
Explore the 21 signals ↗How MCP security works
From inventory to removal.
Read the declarations. Grade them against your policy. Remove the ones you block, with a person approving. Halt one at once when you have to.
- 01 / Inventory
Read every declaration.
Each enrolled device reports its MCP servers, with scope, transport, host and the agents that load them, folded into one list ranked by reach.
Surface capabilities ↗ - 02 / Grade
Set the hosts you permit.
The Permitted MCP hosts and Blocked MCP servers rules grade every device. A blocked server fails the device until it is gone.
Apply your rules ↗ - 03 / Remove
Approve, then remove.
A blocked server waits in the Inbox. Once an administrator approves, the agent deletes its entry by name from every file that declares it. A file that will not parse is left as it was.
Approval-gated removal ↗ - 04 / Halt
Trip a kill switch.
A kill switch removes a server from the agents' configuration across the fleet, by host or by name. Tripping it needs an administrator and a reason, and both go in the audit trail.
The Layer 1 Agent ↗
Configuration and callsWhat it was given,
What it was given,
and what it sends.
The inventory says what an agent could reach. The prompt scanner reads what it sends there, in the hosts it is installed in.
LayerWhat is readWhat EndLayer can do
Declared
MCP declarations in each tool's configuration and in project files.
Grade against permitted hosts and blocked servers; remove a blocked server once an administrator approves.
Called
In Claude Code, Cursor and the Codex CLI: the agent's tool calls, MCP calls and shell commands, before they reach a provider.
Check them with 31 built-in detectors and your own patterns, then monitor, warn, redact or block.
Halted
One server, one agent, or every scanned agent at once.
Refuse every prompt and tool call, or remove the server from every configuration. Releasing restores each device's configuration as it was.
The scanner reads tool calls for sensitive data, not for intent. It does not read a server's tool descriptions, so a poisoned description is found by what the server is and who loads it, not by its text.
Explore guardrails ↗Modelled on what happenedMCP incidents
MCP incidents
have a shape.
Each of these turned on an agent loading a server it should not have trusted. The pattern outlives the patch, so EndLayer looks for the pattern.
IncidentWhat happenedWhat EndLayer shows
A look-alike MCP package added one line in a new version that copied every email it sent to the attacker.
Local servers started from a registry package, the agents that load them, and whether they hold a credential.
A message read through Cursor's Slack MCP server rewrote the agent's MCP configuration, and the edit ran before the user could reject it.
Agents that act unattended while loading local servers, re-read from each device's configuration on every scan.
An agent with database access read a support ticket that told it to read private tokens and post them back, and it did.
One app loading a credentialed server and a remote one together: private data, untrusted input and a way out.
These patterns, and the routes between them across your devices, are what the attack surface view traces.
See the AI attack surface ↗Variable names, not values.
A credential is recognised by the name of the environment variable that carries it. The value is never read or reported.
No connection to any server.
The agent reads files on the device. It does not start, call or probe the servers it finds.
Removal you can audit.
Every removal and kill switch names who approved it and why, and each device reports the outcome back.
Five practical answers
Before you start.
Coverage, reach, removal, privacy and the runtime. These are the details to settle in your evaluation.
Which agents and editors does EndLayer read MCP servers from?
Claude Code, Claude Desktop, Cursor, VS Code, Codex, OpenCode and Gemini, from their user-wide configuration, and project-level .mcp.json, .cursor/mcp.json and .vscode/mcp.json files. Ask for coverage of your exact tools and operating systems.
Does EndLayer connect to the MCP servers it finds?
No. It reads declarations from configuration files on the device and never makes a connection, so it reports what an agent could reach rather than proof that a tool was called.
Can EndLayer remove an MCP server from a device?
Yes. Add the server to Blocked MCP servers; a removal request waits in the Inbox, and once an administrator approves, the agent deletes the server's entry by name from every configuration file that declares it. A kill switch can also remove a server across the fleet at once.
Does EndLayer read the API keys in MCP configuration?
No. A server is marked as holding a credential from the name of a credential-shaped environment variable. The value is never read, reported or stored.
Does EndLayer see the MCP calls an agent makes?
Where the prompt scanner is installed, in Claude Code, Cursor and the Codex CLI, the agent's tool calls, including MCP calls and shell commands, are checked for sensitive data before they reach a provider, and can be warned on, redacted or blocked.
EndLayer
Give AI room to work.And clear boundaries.
See the Guardian Agent Platform on your own fleet. Find every AI tool, understand what it reaches and costs, and apply the controls your team needs.
One connected layer of control
Devices · Cloud · ApplicationsSurface / Monitor / Govern