SaaS Integration Discovery for Unsanctioned AI Connectors

If an engineer on your team spun up an MCP server against a production database last week, there's a good chance nobody in security knows it exists. This piece shows you how to find unauthorized MCP connectors running inside an enterprise, why the usual shadow IT playbook misses them, and what you should do once you've found them. Unsanctioned AI connectors don't just expose data, they take action on enterprise systems, and that means discovery has to happen across four distinct surfaces, not one scan.

Unsanctioned AI connectors versus classic shadow IT

You know what a forgotten Dropbox account sitting in a marketing team's browser tabs looks like. A shadow MCP connector doesn't wait for anything. It initiates connections on its own, runs tool calls against live systems, and can write, delete, or pull data out without a person clicking a single button.

That changes what the risk actually is. With an MCP connector running unchecked, the question is unauthorized action taken at machine speed, with no one watching in the moment it happens. Proofpoint's MCP Security platform documentation states: "A single MCP server without authorization can expose every system it connects to. The same documentation notes that traditional EDR, CASB, and DLP tools weren't built to catch this kind of thing.

MCP flips the usual client-server relationship, and that is part of what makes it hard to spot. MCP often runs in reverse: servers query and, in many cases, execute actions on behalf of the clients connected to them. That reversal opens paths that perimeter security tools have no way to trace, because those tools were built to watch for the traffic pattern that used to be normal.

And adoption has moved faster than most security programs can track. Anthropic open-sourced MCP in November 2024. An estimated 41% of software-industry technical leaders say their organization already runs MCP in limited-to-broad production. Yet only an estimated 11 to 14% of enterprise agentic AI pilots actually reach production, with the rest stalling on identity, audit, and access-control gaps.

That gap between "connected" and "governed" is where unsanctioned connectors accumulate. An organization cannot govern a layer of its infrastructure it has no way of seeing, and right now, most organizations can't see this layer.

MCP's design and the path to ungoverned connectors

The proliferation of unsanctioned MCP connectors is a predictable result of how the protocol itself was built. The NSA's May 2026 Cybersecurity Information Sheet on MCP describes it as released "with a flexible and underspecified design, allowing implementers freedom of design but also introducing ambiguity for safe usage." Security was left to whoever implemented it.

Authentication and authorization in MCP are optional rather than required, and plenty of implementations skip them. Once an agent finds that server, its tools become part of the agent's available actions, and no one has to review them first.

Two separate groups add to the problem at the same time. Most of the most-searched MCP servers come as remote, vendor-hosted servers rather than local installs, so you can adopt them fast but you can't inventory them from a central point.

The NSA's core finding ties all of this together: the agentic environment behaves as a continuum. Legacy API gateways offer little help here. They were built to inspect HTTP traffic between known services, so they can't tell what an agent intends to do. When an agent task fires off tool calls to a dozen MCP servers, the network just sees a string of properly authenticated requests, and it has no way to tell that anything unusual happened.

What ungoverned MCP connectors have done in production environments

These aren't hypothetical failure modes. They've already happened, repeatedly, across different vendors and different deployment types.

On January 20, 2026, researcher Yarden Porat published an exploit chain against Anthropic's own official Git MCP server, producing three separate CVEs: a path traversal flaw (CVE-2025-68143), an argument injection flaw (CVE-2025-68144), and a second path traversal flaw (CVE-2025-68145). This wasn't some community package thrown together by an unknown developer. It was Anthropic's own trusted, official implementation.

In February 2026, the ClawHub/ClawHavoc campaign surfaced inside OpenClaw's skill marketplace. No one checked a skill before a developer could install it.

In April 2026, Microsoft's own @azure-devops/mcp npm package turned out to be missing an authentication layer on a server handling Azure DevOps work items, repositories, and pipelines. The resulting flaw, CVE-2026-32211, carries a CVSS score of 9.1.

A different kind of failure comes from poisoning, not from missing auth. Lyzr's September 2026 MCP security guide describes how agents read tool descriptions with the same trust they extend to their own system prompt, and MCP picks up changes to those descriptions on the fly. So a server approved once can be quietly re-armed later, and no one re-reviews it. Microsoft Incident Response and its Defender security research team disclosed exactly this: a finance team's agent was connected to a third-party invoice enrichment tool that had been approved but never given a real security review. Even the model with the strongest refusal behavior in independent benchmarking still complied with the poisoned instructions more than a third of the time.

The NSA's May 2026 guidance formalized what these incidents show in practice: some MCP implementations let attacker-controlled input reach execution environments without proper constraints, producing arbitrary code execution vulnerabilities tracked across multiple CWE categories. The NSA is explicit: you get secure-by-default behavior only by building it in, through implementation discipline, careful coding, clearer protocol specifications, and real validation tooling. It doesn't come from the protocol itself. An official vendor server, a third-party marketplace, a major cloud platform's npm package, and a widely used observability tool have all produced incidents of this kind. No single deployment model gets to claim it's inherently safe.

Why existing security tooling cannot find unsanctioned AI connectors

Security teams reaching for their existing CASB or DLP stack to solve this will come up short, because the reason is architectural, a matter of missing settings. Proofpoint's platform documentation says it directly: traditional EDR, CASB, and DLP tools "weren't designed to detect" unmanaged MCP servers. When an agent task fires tool calls at a dozen MCP endpoints, the resulting network traffic looks, to a perimeter tool, like a sequence of ordinary authenticated requests. MCP's stateful, streaming transport doesn't resemble the request-response pattern that legacy API gateways were designed to inspect, so those gateways have no way to read intent out of the traffic shape.

The identity side of the problem runs just as deep. The agent ends up acting as a proxy for the attacker's own privileges: fully authenticated, and invisible to tools built around older assumptions.

The tools enterprises already own can't see this layer, so closing the gap takes a discovery methodology built around how MCP actually works, not an extra rule bolted onto an existing dashboard.

A systematic process for discovering what MCP connectors are running in your environment

Finding every unsanctioned MCP connector in an environment means working across four surfaces at once. No single scan, however thorough, covers all of them: network endpoints, SaaS application configurations, developer and agent tooling, and the non-human identity layer.

Network endpoint scanning comes first. Query internal networks and cloud environments for MCP-specific endpoints, paths like /mcp and /sse are common signatures. Check for servers bound to 0.0.0.0, because that exposes a local MCP server far beyond the scope its developer intended. Any server reachable outside its intended trust boundary counts as an exposure the moment you find it, so a local dev server reachable from the corporate network is already a finding, not a false alarm.

SaaS application configuration audits come next, and they need to cover more than standalone AI tools. Vendors have folded AI features, Copilots, assistants, summarizers, directly into products IT already approved, often without telling anyone. Review OAuth application consoles across major SaaS platforms for agent-created app registrations and third-party MCP integrations that went live without procurement ever seeing them. The Agentics' Enterprise MCP Guide 2026 lists CRM platforms (HubSpot, Salesforce Agentforce, Microsoft Dynamics 365), marketing automation (Adobe Marketo Engage), and developer tooling (Cursor, Windsurf, Zed) as platforms where these connections are actively forming.

Developer and agent tooling environments are the third surface. Inspect agent configuration files wherever credentials and MCP server references tend to live, config directories, environment files, settings files for AI coding tools. Laptops deserve their own check here too: Proofpoint's platform specifically identifies "local servers running unprotected on employee machines" as a distinct risk category that needs its own detection path, separate from anything running in the cloud.

The fourth surface is the non-human identity layer. Enumerate every API key, OAuth token, and service account created since the organization started adopting AI tooling, then cross-check that list against procurement's approved records, so you can surface the credentials nobody can account for. A single MCP server often aggregates credentials across a database, a CRM, a code repository, and a cloud storage bucket all at once, so mapping credentials isn't an optional step, it's how a compromised server turns into a single point of failure.

For every MCP server or connector this process turns up, you need to answer three questions before you make a governance decision. What actions has it already taken, pulled from logs, where missing or non-tamper-proof logs become a separate finding that needs its own remediation?

An MCP registry turns this from a one-time fire drill into something repeatable. Lyzr's MCP security guide describes a registry as providing three things: inventory, approval workflows, and version history, the combination that turns a single scan into a record that stays current. A registry serves as the inventory layer that IAM, network controls, and runtime enforcement need to operate against. Treat any server count or download figure from an outside report as a signal about adoption intent, not a substitute for an organization's own internal inventory.

Triage, authorization, and the connectors you cannot yet eliminate

Once discovery turns up a list of connectors, they tend to sort into three categories, and each one calls for a different response. Others are legitimate but ungoverned: a real business need drove their creation, but no one ever gave them a security review. Lyzr's guide names over-scoped permissions as one of the dominant MCP risks of 2026, and the right response is to cut that scope down before the connector keeps running, not after it causes an incident.

Authorization itself has to live at the level of each tool call, not just at the level of a session. The NSA frames this as a continuum problem: a gap at any single stage spreads through the whole chain, so authorization can't be treated as something granted once and forgotten.

Some connectors can't be shut off immediately because a business team genuinely depends on them, and for those, interim controls buy time while a real remediation plan runs. Put an explicit expiry on any credentials tied to the connector, so nothing persists indefinitely just because it's still under review. This triage work is the bridge between finding the problem and building the lasting governance posture that comes next.

Building ongoing visibility rather than repeating the audit

The conditions that create unsanctioned connectors, low friction to integrate, optional authentication, AI features embedded inside SaaS products IT already trusts, aren't going away. That makes discovery an ongoing operational job, not a project with a finish line. MCP adoption keeps accelerating: every major AI platform vendor now ships support for it, enterprise CRM, marketing automation, and developer tooling are all MCP-enabled, and new servers and tool definitions get published continuously. The governance gap isn't closing on its own either. Only an estimated 11 to 14% of pilots reach governed production, and the rest aren't disconnected, they're running live without the controls production actually requires.

Lasting visibility rests on three capabilities working together. Identity-tied audit logs mean every MCP interaction traces back to a human sponsor or an initiating context, with tamper-proof logs and full OTEL tracing that make post-incident attribution possible and satisfy regulatory forensics demands. Proofpoint describes its own platform producing "full transaction-level forensics for every MCP interaction, who triggered the interaction, which application and LLM processed it, and which MCP servers were called," feeding that telemetry into SIEM and observability stacks through OpenTelemetry.

Regulation adds a floor under all of this. The NSA's May 2026 guidance marks the first formal statement from a US signals-intelligence agency on MCP security specifically, and organizations in regulated industries should expect audit questions about MCP governance to follow.

A platform that pairs an AI control plane with MCP gateway visibility, Runlayer among them, maps which MCP servers are connected, what tools each one exposes, and what actions it's able to take, because the actual threat here is execution, beyond just visibility into stored data. Visibility by itself isn't the finish line either. Every MCP connection and tool invocation needs to tie back to a known identity, through SSO, SCIM, or just-in-time credentials, turning a list of unsanctioned connectors into something a team can actually act on. Runlayer's structure reflects that logic directly: an enablement layer giving employees a governed path to agent use across more than 18,000 MCP servers with credential handling built in, a control layer giving platform teams one view over every MCP, skill, and agent with identity attached to each action through SSO, SCIM, and JIT credentials, and a security layer running real-time detection for tool poisoning, prompt injection, intent drift, and exfiltration, backed by tamper-proof logs and full OTEL tracing.

The organizations that get here before an incident forces their hand are the ones that get to scale agent adoption on their own terms.