Introducing Briefings: a daily digest of your riskiest AI agents →
Book a demo
PLATFORM
Platform overviewGuardrailsInvestigation
USE CASES
Coding agentsMCP serversOAuth appsService accounts
RESOURCES
ResearchAttack paths guideGlossaryAboutBook a demo
Use case · MCP servers

Every MCP server is an identity with credentials. See what it reaches.

The Model Context Protocol connects agents to tools, and every tool call runs with some credential: an API key, an OAuth token or a service account. An MCP server is therefore a non-human identity, often with broader access than the agent that uses it.

Book a demoMCP security checklist
github-mcpslack-mcpsnowflake-mcpbilling toolsCRM exportsupabase-mcpdrive-mcpokta-mcp
crm mcp serverMCP
Shared by3 agents
Token scopeFull export
Ownernone
12 tools · 1 credential
THE PROBLEM

Why MCP servers need access review

MCP servers are easy to add and hard to track. A developer connects one to try a workflow, it gets a token with generous scopes, and the token stays. Research on public MCP servers has found long-lived static keys to be common, and the protocol leaves much of authorization to the implementation. Our MCP security checklist covers the protocol-level risks such as prompt injection and tool poisoning.

The question this page is about is different: if an agent or an attacker drives this MCP server, which data can it reach through the credentials behind its tools?

Which MCP servers can reach customer data?
3 servers found
crm mcp serverShared by 3 agents · full export scopeCritical
Experimental MCPNo owner · repo and read scopesMedium
snowflake-mcpService user · read onlyLow
WHAT ELMOZ SHOWS

What Elmoz shows for MCP servers

Five questions Elmoz answers for every MCP server your agents can call.

01Which MCP servers are connected

Including experimental servers without an owner.

crm mcp serverExperimental MCP · no owner
02Which credentials each server uses

The keys, tokens and roles behind its tools and their scopes.

OAuth token · full exportService user · read
03Which agents can call it

An MCP server shared by several agents concentrates their access in one place.

support-agentsales-agentbilling-agent
04Where the path ends

The data stores and production systems reachable through the server's credentials.

customer recordsbilling data
05What to change

Scope the token, split a shared server or remove access that no tool actually needs.

Scope the tokenSplit the server
SHARED SERVERS

One server, three agents. One token for all of them.

An MCP server shared by several agents concentrates their access in one place. If any of them is manipulated, whoever drives it inherits what the server can reach.

support-agentSupport
sales-agentSales
billing-agentFinance
crm mcpOne token for all

An example path

A real case: PocketOS. A Cursor agent found a Railway CLI token in an unrelated file. The token was made for domains, but it could call any Railway operation, including volumeDelete. One API call removed the production volume and the backups stored inside it. Elmoz shows a path like this before it is used.

Security GraphFocus: Cursor agentAll assetsIdentitiesData stores
ATTACK PATH1 API call · 9 seconds
Cursor agentClaude Opus · staging task!Unrelated fileHolds the tokenStagingAssigned environment!Railway CLI tokenCreated for domainsCustom domainsIntended use!All environmentsToken scope: root1GraphQL APIvolumeDelete · no confirm3Findings3 issuesProduction volumeRailway volumeReservationsCustomer data!Volume backupsSame volume

What to change. Without breaking the tools.

Elmoz shows the impact of each change before you make it.

Scope the tokenKeep the tools, drop the export scope no tool needs.
Split a shared serverOne server per agent limits each agent to its own access.
Remove unused accessAccess that no tool actually calls goes first.
FAQ

Questions, answered.

Short answers on MCP servers as identities and how to audit what they reach.

Is an MCP server a non-human identity?

In practice yes. Each MCP server calls other systems with credentials such as API keys, OAuth tokens or service accounts, and those credentials define what it can reach.

What is the main MCP security risk for data?

Broad, long-lived credentials behind tools. If an agent is manipulated or the server is compromised, whoever controls it inherits everything those credentials can reach.

How do I audit MCP server permissions?

List every connected server, the credential behind each tool and its scopes, the agents that can call it and the data those credentials reach. Then scope or remove what no tool needs.

More ways in.

Every use case ends in the same place: a path from an identity to sensitive data.

Coding agentsWhat Cursor, Claude Code and Codex can reach through the credentials around them.Coding agents →OAuth appsEvery grant to an AI tool, its scopes and where a vendor breach would lead.OAuth apps →Service accountsThe service accounts and roles agents reuse, and who owns them.Service accounts →The platformDiscover, trace, prioritize and fix, in one security graph.Platform overview →

See what your agents can reach. Before someone else does.

Book a demo and we walk through the access paths in an environment like yours.

Book a demoRead the attack path guide