MCP governance is the control of which agents may reach which tools, under whose authority, with what evidence left behind.
The Model Context Protocol is how agents reach the outside world, which makes it the highest-leverage place to put controls. The 2026-07-28 specification hardened authorization onto an OAuth 2.1 resource-server model and added Enterprise-Managed Authorization — and started a twelve-month clock on every legacy deployment.
Get an Agent Trust Gap BriefThe clock most teams have not started
The 2026-07-28 specification introduced a stateless protocol core, multi round-trip requests, header-based routing, cacheable list results, a formal extensions framework, and hardened authorization. Legacy protocol versions were given a twelve-month deprecation window.
That places a migration deadline in July 2027 on every enterprise currently running MCP. The work is not enormous, but it is not automatic either, and the authorization changes touch identity infrastructure rather than application code — which means it needs a team that may not know it has been volunteered yet.
The specification also formalises Enterprise-Managed Authorization: organisations provision MCP server access centrally through their identity provider, so users get connected servers on first login instead of clicking through per-application OAuth. Anthropic, Microsoft and Okta are among the adopters. For a governance team this is the difference between an auditable, revocable estate and a sprawl of individually-consented connections nobody can enumerate.
The failure modes the new spec exists to close
Confused deputy
A component with broad permissions is induced to act for a caller with narrower ones. Endemic wherever a server proxies tool access on behalf of many clients.
Token passthrough
An access token issued for one audience is forwarded to another service that accepts it anyway. Audience binding and resource indicators exist precisely to stop this.
Tool poisoning
A tool's description — which the model reads and trusts — carries instructions rather than documentation.
Rug pull
A server changes a tool's behaviour after approval. What was consented to and what now runs are no longer the same thing.
Shadowing
A malicious server registers a tool name that shadows a legitimate one, intercepting calls meant for something else.
Indirect prompt injection
Instructions arrive inside tool output or retrieved content rather than from the user, and the agent has no reason to distrust them.
Taxonomy consistent with the OWASP MCP Top 10 and ASI02 Tool Misuse & Exploitation. The NSA has published a cybersecurity information sheet on MCP security — worth reading before an enterprise rollout.
What governing MCP actually requires
- Server inventory. Every MCP server reachable from your agents, who approved it, and what it can access. Most teams cannot produce this list on request.
- Tool-exposure assessment. Per tool: what it can read, what it can change, what it can spend. Read and write must not sit behind the same consent.
- Per-tool authorization. Scope at the tool, not at the server. "This agent may use this server" is not a permission model.
- Audience-bound tokens. Resource indicators so a token issued for one server is useless at another.
- Consent that survives change. If a tool's definition changes after approval, the approval should not silently carry over.
- Execution receipts on tool calls. Which agent, which tool, which arguments hash, which policy allowed it, what came back.
- Revocation that reaches the server. Removing an agent's grant must actually stop calls, not just stop new sessions.
Where this lands in the standards
| Framework | Mapping |
|---|---|
| OWASP Agentic 2026 | ASI02 Tool Misuse & Exploitation, ASI04 Agentic Supply Chain Vulnerabilities. Plus the dedicated OWASP MCP Top 10. |
| NIST AI RMF | MAP 4.1 third-party and dependency risk; MEASURE 2.7 robustness and security. |
| ISO/IEC 42001 | A.10.2 third-party and supplier controls. |
| EU AI Act | Art. 25 value-chain responsibilities; Art. 15 accuracy, robustness and cybersecurity. |
Mappings are ApexClaw's interpretation, published to be checked. Last verified 2026-08-06. Not legal advice. Full crosswalk →
Common questions
What changed in MCP 2026-07-28?
The revision hardened authorization. The practical consequence is a migration clock and a tightening of how tool access is granted and proven.
Is an MCP server a third party?
In substance yes. It exposes tools your agent will call with your credentials, which is exactly the relationship third-party risk regimes were written for.
What is the main MCP governance risk?
Tool exposure. An MCP server can expose more capability than the task requires, and the agent will discover and use it.
Should MCP servers be inventoried?
Yes — which servers, which tools, which agents can reach them, and who owns each. Most organisations cannot currently produce that list.
Does OAuth 2.1 solve MCP security?
It addresses authorization. It does not address whether a permitted call is an appropriate action, which is a policy question at the effect boundary.
The 2026-07-28 MCP specification hardened authorization for a reason. The teams that planned the deprecation window will not be the ones explaining a confused-deputy incident.
Sources
The 2026-07-28 MCP specification hardened its authorization model onto OAuth 2.1 with an Enterprise-Managed Authorization extension, and gave legacy versions a twelve-month deprecation window — most teams have not yet planned for it. The exposure an ungoverned MCP server creates is the same one Gartner counts toward its projection that more than 40% of agentic AI projects will be cancelled by the end of 2027, and the EU AI Act's penalty tiers of up to 7%, 3% and 1% of global turnover apply whether the failure originated in your own code or a third-party MCP server you called. Standards this surface maps to:
- The specification itself: MCP 2026-07-28 authorization changes.
- Tool-exposure and confused-deputy risk: OWASP Top 10 for Agentic Applications.
- Third-party and supply-chain risk practice: NIST AI RMF.