# Every MCP server, found. Every tool call, governed. > Find every MCP server on every laptop, score it on evidence, and govern every tool call through one gateway. Read-only agent, works with any MDM. Source: https://www.lutril.com/mcp-governance --- People add MCP servers to Cursor, Claude Desktop and VS Code with a token in a config file. Nobody approved them. Lutril finds them on the device, scores them, and governs the ones you keep. ## A closed loop, from the laptop to the audit log. A gateway only governs what you route through it. Lutril starts on the laptop, where shadow MCP lives, and ends in the audit log. ### 1. Find every MCP server on every laptop A read-only agent, deployed by your MDM, reads the MCP config of 17 AI clients on macOS, Linux and Windows. It never reads a secret's value and never runs what it finds. - Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Codex CLI and more - Running MCP processes observed, not only config files - Personal configs and the ones committed in repositories ### 2. Score on evidence, decide once for the fleet Signals become a score with public weights. One decision covers every install of the same definition. A server that changes after approval is reopened and announced in Slack and Teams. - Approve, reject or accept the risk, with a note - Rug-pull detection through a hash of each definition - Every finding names its fix ### 3. Promote what you keep behind the gateway A remote server the fleet already uses becomes a registry entry in one click, at the same origin. It inherits OAuth 2.1 sign-in, tool inventory, write grants, redaction and audit. - The registry entry is the server that was found, never a substitute - Tools synced and classified read, write or destructive - Local stdio servers stay approval-only ### 4. Govern every tool call, and prove it Every call arrives as a named person or a registered agent. Policy checks the tool and its arguments, a write asks for approval in Slack, Teams or the app, and each call lands in an append-only log. - Argument rules refuse a branch, a channel or a record by value - One kill switch for one agent or all of them - Agents sit in the same access reviews as people ## A gateway sees what you route through it. The device sees the rest. Most MCP servers are local processes the AI client starts itself. Their calls never cross a gateway, so discovery has to run on the endpoint. **What passes through the gateway** - Remote servers you registered - Callers signed in through your identity provider - Policy on tools and argument values - One audit line per call **What only the device can show** - Local servers the client launches itself - A token in cleartext in a config file - An approved entry swapped for another command - A server committed in a repository - A config file any local account can edit The MCP client flaws of 2026 were all local: an approved entry replaced without a new prompt, and a web page writing a server into a config file. The definition hash catches both on the device. ## Decisions in Slack, Teams and the app. The loop runs where your security team already works. - **Alerts in your channel** A high risk server or a changed definition is posted to the channel your Shadow IT alerts already use, at most once a day per problem. - **Write approvals in the conversation** A write without a grant becomes a request to the app owner in Slack, Teams or the app. The grant can be time-boxed or single-call. - **One console for the fleet** Definitions grouped across installs, devices with their last report, and partial scans or inferred identities labelled as such. ## Frequently asked questions ### What is shadow MCP? Shadow MCP is an MCP server connected to an AI client without review, inventory or owner. It appears when someone pastes a server and a token into the config file of Cursor, Claude Desktop or VS Code. From then on an AI model can reach whatever that server reaches, under that person's account. OWASP lists shadow MCP servers as MCP09 in its MCP Top 10. ### How does Lutril discover MCP servers on employee laptops? A read-only agent, deployed by your MDM, reads the MCP config files of 17 AI clients and observes running MCP processes. Once an hour it sends the shape of each definition, never a secret's value. Lutril scores it and groups it with the same definition found on other devices. ### Which AI clients are covered? Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Cline, Roo Code, Continue, Zed, Codex CLI, Gemini CLI, Goose, Amazon Q, Kiro, LM Studio, opencode and JetBrains AI, including their per-repository files. Web-only clients such as ChatGPT keep their connectors server-side; the gateway and the browser extension cover those. ### Does the agent run the servers it finds to list their tools? No. Running a local server means executing a command an attacker may have written. The agent only reads configuration, and a test fails the build if an exec call appears in the scanner. Tools are enumerated in the gateway, for the servers you route through it. ### What is a rug pull, and how is it detected? A rug pull is a server that is clean at approval and hostile after an update, because clients reload definitions without asking again. Lutril hashes each definition and reopens the review when the hash changes, with the diff shown and an alert in Slack and Teams. ### What happens when I approve a definition? The decision covers every install of that definition in the fleet, with your note. Findings about one copy, such as a token in cleartext in one person's file, stay open on that install: approving a command does not approve a badly stored secret. ### Can a discovered server be put behind the gateway? A remote server can, in one click, at the same origin the fleet already uses. It then gets OAuth 2.1 sign-in, a tool inventory, write grants, redaction and the audit log. A local stdio server has no network path, so it is approved or rejected where it is. ### What does the gateway enforce on a tool call? Who is calling, which server and tool, which argument values, and whether the caller holds a write grant. A write without a grant becomes an approval request in Slack, Teams or the app. Responses can be redacted; arguments are never rewritten. Every call is logged. ### Does this require a specific EDR or MDM? No. The agent is one executable with no runtime and no third-party dependency, installed by Intune, Jamf, Kandji, Workspace ONE or a terminal. It talks only to your Lutril instance and needs no other endpoint product. ### What does the agent send, and what does it never send? It sends the shape of each definition: name, client, command, argument shape, variable names, package and pinning, remote origin, file permissions and a hash. It never sends a secret's value, a file's contents, a process command line or a path with a username. The dry-run flag prints the exact payload.