AI & MCP
New runtimes. New identities.Same graph.
Model platforms issue keys, agent frameworks hold credentials, MCP servers expose tools, coding agents run with developer permissions — and most of it arrived without a security review. Trustivan discovers MCP servers and their tools, governs the agent identities a deployment holds, and says plainly what no connector can see.
An LLM is never the security boundary — authorization happens outside the model
AI identity types
The identities AI adoption creates
They hold credentials like service accounts, consent like OAuth apps, and act like neither. Each needs an owner, a purpose and a view of what it can reach.
Model platform identities
API keys, projects, service accounts and workspaces on model providers — often created per developer, rarely retired
Agent runtimes
Agents built on orchestration frameworks and cloud agent services, with their invocation roles and credentials
MCP servers & tools
Servers and the tools agents can call, each tool with an effect its publisher declares — or leaves unstated
Coding agents
Agent sessions running with a developer’s credentials, MCP configurations and tool access on laptops and runners
AI & MCP risks
Where agent deployments leak authority
Six failure patterns specific to AI runtimes and MCP, what Trustivan surfaces for each and its honest status — including what is not built, by design.
Shadow AI
Not surfaced, by designAssistants that connect through OAuth, provider keys or local MCP configurations are not discovered — agent discovery is refused. An agent identity with no profile is still flagged.
Inherited developer authority
Not surfaced, by designCoding agents act from developer machines with a person’s permissions. Endpoint telemetry is refused, so these sessions are not observed.
Unclassified MCP tools
Trustivan surfacesTools whose publisher declares no effect, discovered by the MCP connector — the gate challenges any mutating action through an unclassified tool
Entitled tools that reach high impact
Trustivan surfacesAgents entitled to a tool whose graph edge reaches a high-impact resource. A tool’s reach cannot be declared, so only edges the graph holds count.
Provider key sprawl
Planned signalModel-platform keys in notebooks, repositories and chat — no model-platform connector ships. A key reported exposed through the ingestion API is still matched to its credential.
Agent-to-agent delegation
Not surfaced, by designAuthority delegations are recorded and one agent delegating to another is flagged; provenance across the chain is refused.
How it works
Find the tools. Entitle the agents. Then decide what they may do.
MCP tool discovery and runtime authorization are built. Agent discovery is not built, by design — and it is labelled as such.
Find the MCP servers and every tool they expose
Agents leave traces — provider keys, OAuth consents, local MCP configurations — but no connector discovers an agent, and no screen registers one. The MCP connector reads a server's tools/list: each tool, its publisher-declared effect and the server it belongs to. It never calls a tool and never reads resources or prompts.
- MCP servers and tools inventoried, each tool tied to its server, with its effect marked publisher-declared.
- Coding agent sessions on developer machines are not observed — endpoint telemetry is not built, by design.
- Unprofiled agents flagged: an agent identity with no profile raises a finding.
An agent’s authority is bounded by its entitled tools
A tool is a permission with a friendlier name. Trustivan records which tools an operator entitled each agent to and each tool's effect, and flags an entitled tool whose graph edge reaches a high-impact resource. MCP tools report no target resource and a tool's reach cannot be declared, so reach through a tool shows only where the graph already holds the edge.
- Tool effect per tool, publisher-declared from its annotations and overridable by an operator.
- Entitlements per agent, declared by an operator, because no agent-to-tool use is ever observed.
- Reads are not gated; a write through a tool the agent is not entitled to is denied once its entitlements are declared.
Between the model and the tool, a decisionAvailable
The runtime gate is built. An agent runtime presents its credential and the acting principal is resolved from it rather than claimed in the request; thirteen deny-by-default rules evaluate the entitled tool, its effect, the resource's impact and the grants behind it; and the strictest verdict — ALLOW, CHALLENGE or DENY — is recorded with the rule that fired. Prompt injection can change what the model asks for; it cannot change what the gate allows. No connector discovers an agent and no screen registers one; operators declare the tool entitlements the gate decides over.
Should this agent perform this action on this resource, right now, with this authority?
Explore Agent Runtime Securitycleanup-bot → s3:DeleteBucket prod-backupsThe model can request an action. The authorization system decides.- Action requests3:DeleteBucket
- Principalfrom the credentialnot from the request
- Credentiallive · unexpired
- Tool entitlementdeclared by operator
- Effectmutating
- Resourcehigh impact
- Autonomyautonomous
- Standing grantnone active
- ALLOW
- CHALLENGE
- DENY
mutating_action_on_high_impact_resource and no_active_grant_for_elevated_action. Both route the action to a person. The strictest verdict wins, the rules that fired are named on the decision, and the record cannot be edited afterwards.Integration coverage
AI and MCP connectors, labelled honestly
The Model Context Protocol connector ships today. Model platforms, agent services and frameworks are planned; coding agents on developer machines are not built, by design. Names are used nominatively.
View all integrations- Model Context ProtocolMCP servers and their tools, with publisher-declared effectAvailable
- Amazon BedrockInvocation roles, knowledge base accessPlanned
- Anthropic ClaudeAPI keys, workspacesPlanned
- Azure OpenAIDeployments, keys, managed identity accessPlanned
- LangChain / LangGraphTool registries, credentialsPlanned
- OpenAI PlatformAPI keys, service accounts, projectsPlanned
- Vertex AIService accounts, IAM bindingsPlanned