Trust every MCP server your agents load

Teams are wiring AI agents to MCP servers faster than anyone is reviewing them. Every entry in a .mcp.json is third-party code — or a third-party endpoint — running with your agent's privileges. RingZero treats that config as a first-class security surface: it inventories every MCP server configured anywhere in your org, cross-checks each one against the registry, scans for MCP-specific threats, and hands you the exact config diff that fixes what it finds.

MCP is a new attack surface

The threats are not hypothetical, and most of them are invisible to traditional scanners because they live in agent configuration rather than application code:

• Typosquatted packages — a server one transposition away from the official name, published by a fresh account, riding into every agent session.
• Secrets committed in config — live credentials sitting inline in a server's env block, readable by anyone with repo access.
• Prompt injection in tool descriptions — hidden instructions aimed at the calling agent, smuggled inside metadata the user never reads (tool poisoning).
• Excessive scope — filesystem roots that hand every session $HOME, including ~/.ssh.
• Unpinned versions — servers that re-resolve latest on every launch, so tomorrow's compromise ships silently.
• Unapproved remote endpoints — HTTP servers nobody put through review, pointed at domains that aren't the vendor's.
• Unsigned packages — resolved versions published without provenance attestation, so you can't tie the artifact back to its source.

How RingZero secures your MCP fleet

1. Discover every server

The scanner walks your connected repos for MCP configuration and builds an org-wide inventory: package or endpoint, transport, which config declared it, how many teams load it, what tools it exposes, and what scopes it holds. Shadow agent-tooling can't accumulate unreviewed, because the inventory is the review.

2. Cross-check the registry

Each server is verified against registry metadata — provenance attestations, publisher signals, typosquat distance, official vendor domains — and scanned for the finding categories above. Every finding explains why it was flagged: the publisher-account age, the live-credential check, the hidden-instruction payload.

3. Derive trust, don't assert it

Each server carries a trust status — flagged (open critical or high finding), unverified (only medium/low open), or verified (registry-checked, nothing open) — recomputed from open findings on every change, never stored as an opinion. An org-level MCP trust score rolls the whole fleet into one number that visibly recovers as fixes land.

4. Fix with a config PR

Every MCP finding is config-shaped, so every fix is a reviewable .mcp.json diff — approve it and RingZero opens a pull request against the owning repo through the same human-in-the-loop remediation pipeline used for code findings, with a full audit trail.

Why not just review servers by hand?

A one-time review answers "is this package safe today?" — it doesn't watch the publisher account change hands, the version re-resolve, or the fourth team quietly add the same server with broader scopes. RingZero re-scans on config change, keeps the whole fleet in one place, and pairs each finding with its fix, so remediation is a review click instead of a research project. Package-level supply chain risk beyond MCP is covered by dependency scanning, and everything lands in the same findings workspace as your AI penetration tests.

Want to see it? Play with the interactive MCP registry demo on the home page.

Frequently asked questions