Table Of Content
Know What Your AI Agents Can Do: Securing Coding Assistants and MCP Servers on Every Endpoint
-
November 11, 2026
-
Summary: AI coding assistants and the MCP servers that plug into them can now read files, run commands and send data out with an employee’s own access. Security leaders who can see which agents run on which devices, and what each one is allowed to do, can say yes to AI productivity without handing over the keys.
A Tuesday afternoon at a 600-person company
The following scenario is illustrative.
Priya is a senior engineer at a 600-person logistics software company. Her team’s sprint is behind, so she installs an AI coding agent on her laptop and connects it to a few community MCP servers: one for the team’s Git repos, one for the internal ticketing system and one that sends email summaries to customers. She switches the agent to auto-approve so it stops asking before every command.
It works. The sprint closes on time. Two months later, a routine package update pulls in a tampered version of the email MCP server. It quietly copies every outbound message to an outside address. Those messages include customer contract terms and, in a few cases, API keys pasted into tickets.
Nobody on the four-person security team knew the agent existed. The firewall saw ordinary HTTPS traffic from a managed laptop. The DLP tool saw nothing, because nothing was uploaded through a browser.
The problem: agents act with your employees' access
An AI agent is software that plans and takes actions, not just answers questions. On a laptop, that means it can open files, run terminal commands, call APIs and push data to outside services. It does all of this with the permissions of the person who installed it.
Most organizations have not set limits. In a Q2 2026 survey of 297 cybersecurity leaders, Gartner found that 54% of organizations have no defined approach to limit AI agent access, or rely on predefined human access. Adoption is moving faster than governance: 71% of organizations expect to deploy agentic AI within 12 months, yet only 21% have agentic AI governance in place.
The cost is already showing up in breach data. IBM’s Cost of a Data Breach Report 2026 found that:
- Security incidents involving shadow AI more than doubled, to 43% from 20% the year before.
- Those incidents cost an average of USD 5.39 million.
- 92% of organizations that had an AI-related breach lacked proper AI access controls.
The risk is not hypothetical. In September 2025, researchers found the first malicious MCP server in the wild: a look-alike email package that silently BCC’d every message to an attacker. Weeks earlier, a compromised build tool prompted AI command-line tools already installed on developer machines to hunt for secrets. The stolen credentials were later used to make more than 6,700 private repositories public.
Small and mid-size companies are exposed in a particular way. Developers and power users adopt agents on their own, and a lean security team has no time to chase every install.
How Gen AI changed the risk
The first wave of Gen AI risk was about what people pasted into a chatbot. That risk has not gone away. Verizon’s 2026 Data Breach Investigations Report found that 45% of employees now use AI regularly on corporate devices, up from 15% a year earlier, and 67% do so with non-corporate accounts. Source code was the most common data type sent to outside AI models.
Agents add four new problems on top of that:
- Shadow agents, not just shadow apps.Gartner lists agentic AI oversight first among its top cybersecurity trends for 2026, noting that employees, developers and vibe coding are driving unmanaged agent proliferation.
- Plug-ins with real power. MCP servers, connectors, skills and hooks give an agent new abilities in seconds. Many are community-built and pulled in unpinned, so a later update can change what they do.
- Autonomy. Auto-approve modes let an agent chain dozens of actions with no human checkpoint.
- Machine speed. An agent can read a folder, summarize it and send the result out in one workflow, faster than any analyst can review an alert.
Why legacy approaches fall short
Most security stacks at mid-size companies were built for people using browsers and SaaS apps. Agents break their assumptions.
- Pattern-based DLP looks for credit card numbers and keywords in files and form fields. It does not know that a process on the laptop just read 400 files and called an outside API.
- Network-only and cloud-proxy inspection sees encrypted traffic to an AI provider or a developer API. It cannot tell a human prompt from an agent tool call, and it misses traffic that skips the tunnel or runs offline.
- Block-everything policies push engineers to personal devices and personal accounts. The agents still run; you just stop seeing them.
- Heavy platforms promise full coverage but need a dedicated team to tune. A lean team ends up with alerts nobody reads.
The common gap is context. None of these tools can answer the basic questions: which agents are installed, what can each one do, and what data did it touch?
What a modern approach looks like
The goal is not to ban agents. It is to know them, scope them and catch misuse before data leaves. Public guidance points the same way. CISA and its international partners advise organizations to avoid granting agents broad or unrestricted access and to start with low-risk use cases. Gartner recommends that CISOs govern agents by their action privileges rather than model intelligence, and identify both sanctioned and unsanctioned agents. The OWASP Top 10 for Agentic Applications gives teams a shared list of risks to test against.
In practice, five principles stand out:
- 1.Inventory continuously. Find every agent, extension, CLI and MCP server on every device, including ones IT never approved.
- 2.Judge agents by what they can do.Can it run code, change external data, send data out, hold secrets or act without approval? Those capabilities define the risk.
- 3.Watch the supply chain. Flag unpinned or untrusted MCP servers, skills and plug-ins, and know which versions are installed.
- 4.Enforce where the action happens. The endpoint is the one place that sees the user, the agent process, the file and the destination together.
- 5.Prioritize, don't drown. A short list of fixes ranked by risk beats a thousand raw alerts for a lean team.
How Kitecyber helps
Kitecyber is an endpoint-first data and Gen AI security platform. One lightweight agent and one console cover the device itself, which is where AI agents actually run. That gives it the context a network tool lacks: the user, the agent process, the file and the destination, all at once.
For AI agents and MCP servers, the relevant capabilities are:
- AI Apps & Agents inventory. Discovers AI agents and coding assistants on every endpoint, such as Claude Code, Copilot, Cursor, Codex and Ollama, plus AI browser extensions. Each agent shows user and device counts, installed versions and known CVEs, across macOS, Windows and mobile.
- AI Agent Security posture view. Gives each device and agent a High, Medium or Low risk rating with the reason in plain language, for example "It can run unpinned or untrusted third-party code." A capability matrix shows whether each agent runs code, changes external data, sends data out, holds secrets or admin access, acts without approval, or uses third-party code.
- MCP and plug-in inventory. Lists each agent's MCP servers (local or remote), connectors, extensions, skills, hooks, workspaces, configs and running processes, each risk-scored against 26 built-in risk rules.
- Prioritized fixes.Risk signals with severity, blind spots (what the scan couldn't see and how to fix it) and recommendations such as "pin the git MCP server."
- Data protection at the point of contact. Data Shield classifies data across 80+ categories, including source code, PII and PHI, and can allow, warn or block when a person or an agent touches sensitive data, before it leaves the device. Incident reports are generated in minutes when agent activity and sensitive data combine suspiciously.
What day one looks like. The agent deploys in about a day with pre-built compliance policies and under 2% CPU overhead. By the end of the first day, the console shows which AI agents run where, which ones are high risk and why, and a short list of fixes. Policies keep working when laptops are offline.
Illustrative example · AI Agent Security posture view, fictional data
In the example above, one coding agent can run code, send data out and act without approval, so it rises to the top with two specific fixes.
SME decision-maker checklist
Quick wins for this week, and questions to put to any vendor:
- ☐ Count the agents. Can you list every AI agent, coding assistant, AI CLI and browser extension on your endpoints today, including unapproved ones?
- ☐ Map the plug-ins. Do you know which MCP servers and connectors each agent uses, and whether they are pinned to a trusted version?
- ☐ Find auto-approve. Which agents can run commands or send data without a human approving each step?
- ☐ Scope access. Have you separated agent access from the full access of the person who installed it, as CISA recommends?
- ☐ Test the data path.If an agent reads a customer file and calls an outside API, would any tool you own see it, and could it block it before the data leaves?
- ☐ Ask about effort. How long does deployment take, and how many people does it need to run? Ask for a day-one view, not a 90-day project plan.
The compliance angle
Expect auditors to treat AI agents like any other software with access to regulated data.
- SOC 2 and ISO 27001 expect an asset inventory, access control and change management. An agent with unreviewed MCP servers is an unmanaged asset with privileged access.
- HIPAA and PCI DSS require you to know where PHI and cardholder data flow. An agent that reads patient or payment records and calls an outside service creates a new flow you must control and log.
- GDPR applies when an agent sends personal data to an outside service. That processing needs a lawful basis and, often, a processor agreement.
- CMMC requires protecting controlled unclassified information on every endpoint that touches it, including those running AI tools.
- The EU AI Act and the NIST AI Risk Management Framework both stress data governance, human oversight and logging. An agent inventory and a record of what agents did with sensitive data are a practical start.
The common thread: you cannot show control over something you cannot see.
Key takeaways
- AI agents and MCP servers already run on your endpoints with your employees' access, and most organizations have not set limits on what they can do.
- Judge agents by their capabilities: running code, sending data out, holding secrets and acting without approval. Then fix the riskiest few first.
- The endpoint is the one place that sees the user, the agent, the data and the destination together, so that is where visibility and enforcement belong.
See it on your own endpoints. Schedule a walkthrough at kitecyber.com and get a day-one view of every AI agent, its capabilities and the fixes that matter most.
Ajay Gulati
Ajay Gulati is a passionate entrepreneur focused on bringing innovative products to market that solve real-world problems with high impact. He is highly skilled in building and leading effective software development teams, driving success through strong leadership and technical expertise. With deep knowledge across multiple domains, including virtualization, networking, storage, cloud environments, and on-premises systems, he excels in product development and troubleshooting. His experience spans global development environments, working across multiple geographies. As the co-founder of Kitecyber, he is dedicated to advancing AI-driven security solutions.
