What is a shadow MCP server and why is it a risk?
A shadow MCP server is a Model Context Protocol server that someone connected to an AI assistant without IT knowing, usually to save time: a connector to the company mailbox, a file share, a code repository, a database or a ticketing tool, installed from a public listing or written in an afternoon. The risk is that it quietly creates a new access path. It often holds a personal access token or API key with broad rights, stored in a configuration file on a laptop; it may come from an unknown author and update itself; it lets the AI act on company systems with that person's permissions; and anything the AI reads, including a malicious instruction hidden in a document or web page, can steer what it does through that connector. Nobody reviews or logs it, and it survives the employee's departure if the token is not revoked. Practical steps: publish an approved list of MCP servers, scope tokens narrowly and rotate them, check identity-provider logs for new OAuth grants to AI clients, and include connectors in offboarding. A network sensor sees connections from a laptop to remote services, not the MCP configuration on it.
This answer is part of the guide: Shadow AI: what it is and how to find it