AccuroAI
Book a demo
AccuroAI/Feature

An MCP server inventory with a risk score on each.

An MCP server inventory lists every Model Context Protocol server your employees' AI tools can call. AccuroAI finds each one on every managed device, ties it to the person, device and AI tool using it, scores it 0 to 100, and blocks risky servers by policy.
app.accuroai.co
Live
Feature · MCP Server Inventory — AccuroAI dashboard
Sound familiar?

The problems this exists to solve.

Shadow MCP is one config line away
A developer adds an MCP server to Cursor or Claude Desktop with a single line in a config file. No ticket, no review, no record, and the agent can now reach files, databases or SaaS data.
Network tools never see it
Local stdio servers talk to the agent on the same machine. Nothing crosses a proxy or a firewall, so tools that watch the network have no MCP server inventory to show you.
Tool descriptions are instructions
An agent reads every tool description and may follow what it says. One poisoned description next to a server that sends messages externally is a working path out of the company.
MCP server inventory

Every MCP server, scored and owned.

The endpoint agent reads the MCP configurations in AI IDEs, CLI agents and desktop AI apps on each device. Every server gets a 0 to 100 risk score, capability tags and findings, tied to the people and devices that run it, so the high-risk servers with no endpoint policy are the first thing you see.
MCP servers
64
on 212 devices
Critical & high
9
of 64 servers
Hidden instructions
1
tool poisoning in a description
Risky & unprotected
3
high risk, no endpoint policy
Riskiest MCP servers
acme-corp · sorted by risk score
  • slackstdio
    84 · High
    Used in Claude Desktop, Cursor · Emily Carter and 11 others · 14 devices
    SaaS data readsSends messages externally
    • Read + exfiltrate combination
    • Unpinned package version
    ○ Unprotected · no endpoint policy
  • puppeteerstdio
    79 · High
    Used in Cursor · David Kim and 4 others · 5 devices
    Browser automationArbitrary URL fetch
    • Hidden instruction in a tool description
    • Third-party server
    ○ Unprotected · no endpoint policy
  • postgresstdio
    73 · High
    Used in Claude Code · Rachel Torres and 6 others · 7 devices
    Database readsDatabase writes
    • Third-party server
    ○ Unprotected · no endpoint policy
  • filesystemstdio
    71 · High
    Used in Claude Code, Claude Desktop, VS Code · Michael Brooks and 22 others · 26 devices
    Local file readLocal file write/delete
    • Unpinned package version
    ● Protected · Engineering endpoint policy
  • githubhttp
    58 · Medium
    Used in VS Code, Gemini CLI · Adam Bailey and 17 others · 19 devices
    Code repository writesSaaS data reads
    ● Protected · Engineering endpoint policy
  • fetchstdio
    52 · Medium
    Used in Claude Desktop · Sarah Mitchell and 8 others · 9 devices
    Arbitrary URL fetch
    • Unpinned package version
    ● Protected · Default endpoint policy
  • notionsse
    41 · Medium
    Used in Claude Desktop · Emily Carter and 9 others · 10 devices
    SaaS data readsSaaS data writes
    ● Protected · Default endpoint policy
  • linearhttp
    23 · Low
    Used in Cursor, Claude Code · David Kim and 12 others · 13 devices
    SaaS data readsSaaS data writes
    ● Protected · Default endpoint policy
Showing 8 of 64 serversExport
What agents can do through MCP
servers per capability, of 64
  • SaaS data reads31
  • Local file read22
  • SaaS data writes18
  • Arbitrary URL fetch14
  • Local file write/delete12
  • Sends messages externally9
  • Code repository writes8
  • Database reads7
  • Browser automation5
  • Database writes4
Employees exposed to risky & unprotected servers24
Policy · block and alert
Block puppeteer on all devices
Agents can no longer call the server. Each attempt sends an immediate alert to #sec-alerts on Slack and to the security team by email.
EmailSlackMicrosoft Teams
Kill switch: stop or quarantine an agent session on the spot.
Capabilities

Built for enterprise AI.

Every MCP server on every device
The endpoint agent reads the MCP configurations of AI IDEs (Cursor, VS Code, Antigravity, Xcode), CLI agents (Claude Code, GitHub Copilot CLI, Gemini CLI) and desktop AI apps such as Claude Desktop. Each server is listed with the AI tool that uses it, the employee and the device, and can be filtered by transport: stdio, http or sse.
A 0 to 100 MCP risk score
Every server gets a risk score and capability tags for what it can do: sends messages externally, SaaS data reads, SaaS data writes, local file read, local file write/delete, database reads, database writes, code repository writes, browser automation and arbitrary URL fetch.
Findings and a tool-poisoning scan
Findings flag the patterns that matter: a read + exfiltrate combination, a third-party server or an unpinned package version. Tool descriptions are scanned for hidden instructions, the text an agent reads and may obey, which is how MCP tool poisoning works.
Block, alert, stop
A policy can block an MCP server or a specific agent action, and the alert goes out immediately by email, Slack or Microsoft Teams. The kill switch stops or quarantines an agent or session on the spot, and the full inventory exports for your risk register.
In practice

How it works for your team, day to day.

01

Find every MCP server, including shadow MCP

The endpoint agent reads MCP configurations on each managed device, so it finds MCP servers on developer laptops whether they run locally over stdio or remotely over http or sse. Each server shows which AI IDE, CLI agent or desktop app uses it, and the people and devices behind it. The same servers appear on each employee's inventory page and in the AI assets graph for each device.

Servers used by Cursor, VS Code, Claude Code, Gemini CLI, Claude Desktop and more
Each server tied to the employee, the device and the AI tool
Filter by transport: stdio, http or sse
No firewall, proxy or DNS logs needed
02

Score what each server can do

Each server gets a 0 to 100 risk score built from what it can do, shown as capability tags, plus findings for the combinations that matter. The tool-poisoning scan checks every tool description for hidden instructions. A chart shows what agents can do through MCP across the company, and the number of employees exposed to the riskiest servers.

10 capability tags, from local file read to sends messages externally
Read + exfiltrate, third-party server and unpinned package version findings
Hidden instructions in tool descriptions flagged as tool poisoning
Employees exposed, counted
03

Close the risky & unprotected gap

The inventory splits servers into protected and unprotected, by whether an endpoint policy covers them. The risky & unprotected view lists high-risk servers with no policy, so the first fix is obvious. Block the server or a specific agent action, alert your team immediately, and stop or quarantine an agent session when it has to stop now. Every event lands in the audit log that streams to your SIEM.

Protected and unprotected servers side by side
Policies that block an MCP server or an agent action
Immediate alerts by email, Slack or Microsoft Teams
Kill switch and quarantine, plus export for your risk register
FAQ

The questions we hear most.

What is an MCP server inventory?

An MCP server inventory is a list of every Model Context Protocol server that AI tools in your company can call. AccuroAI builds it from the endpoint, showing each server with the AI tool that uses it, the employee and device, a 0 to 100 risk score, capability tags, findings and whether an endpoint policy protects it.

How do I find MCP servers on developer laptops?

Deploy the AccuroAI endpoint agent through your MDM or, for a pilot, without MDM. It reads the MCP configurations of AI IDEs, CLI agents and desktop AI apps such as Cursor, VS Code, Claude Code and Claude Desktop, so local stdio servers show up even though they never touch the network.

How is the MCP risk score calculated?

Each server gets a 0 to 100 score based on what it can do, shown as capability tags such as database writes, code repository writes, browser automation or sends messages externally. Findings such as a read + exfiltrate combination, a third-party server, an unpinned package version or hidden instructions in a tool description are listed next to the score.

What is MCP tool poisoning and how does AccuroAI detect it?

MCP tool poisoning hides instructions inside a tool description, text the agent reads and may obey, such as a request to send file contents somewhere. AccuroAI scans the tool descriptions of every MCP server it finds for hidden instructions and flags the server, so a policy can block it with an immediate alert.

Can AccuroAI block a risky MCP server?

Yes. A policy can block a specific MCP server or a specific agent action, and the alert goes out immediately by email, Slack or Microsoft Teams. Most teams start with the risky and unprotected servers. When an agent session has to stop now, the kill switch stops or quarantines it.

Related
Solution
Govern every MCP server your agents touch.
MCP gives AI agents direct access to files, databases and SaaS apps, usually through a config edit nobody reviews. AccuroAI finds every MCP server on every managed device, scores each one from 0 to 100 by what it can do, and blocks the risky ones by policy, with an immediate alert.
Learn more →
Solution
Ship faster with AI. Keep the repo at home.
Claude Code, Cursor, Copilot and Gemini CLI read your repository and run commands on the developer’s machine. AccuroAI maps every AI IDE, CLI agent, MCP server and local model on each device, redacts secrets before they leave, and blocks destructive agent actions by policy, with an immediate alert.
Learn more →
Feature
Prioritize AI exposure by actual risk level.
Not every AI tool carries the same risk. AccuroAI gives every app employees use and every MCP server on their devices a 0 to 100 risk score, shows which high-risk apps still need review, and turns the answer into a policy.
Learn more →
Stop guessing. Start governing.

Most teams cannot produce a list of the AI actually running in their business. A 30-minute demo shows you yours: every tool, every user, every risk, on your own estate.

Book a demoTake the free AI readiness assessment

15 enterprises secured · under 38ms p99 · Deployed in under 30 minutes · 72-hour pilot