Skip to main content
Colorado ADMT: 1 Jan 2027 · EU high-risk: 2 Dec 2027 (Annex III); 2 Aug 2028 (Annex I)
Home › Tools › Shadow MCP Exposure Check
Shadow MCP governance check

Shadow MCP Exposure Check

Find out in under 4 minutes whether unapproved MCP servers are already operating inside your enterprise perimeter.

3-4 minutes 12 scored questions No login

This is a governance visibility screen for unmanaged, local, containerized, or otherwise unapproved MCP deployments. It is not a network scanner, gateway, or telemetry product.

  • Screens discovery coverage, registry discipline, local or containerized MCP spread, auth quality, reachable systems, logging, credential handling, disable readiness, and approval workflow maturity.
  • Separates controlled MCP footprint from material shadow exposure before hidden deployments turn into a larger governance or incident problem.
  • ACT is one editable AI Controls Toolkit with eleven core files across eight workflow areas. It supports evidence collection and human decisions; it does not enforce controls or certify compliance.
Start assessment See ACT pricing
Enterprise scene showing hidden and approved MCP servers across controlled and uncontrolled environments with allowlist, logging, disable controls, and oversight visibility.
Shadow MCP visibility across allowlists, local or containerized deployments, auth control, logging, and disable readiness.
Shadow MCP

This screen classifies shadow MCP exposure quickly. It does not scan your network, enumerate servers, or export an inventory.

Interactive screen

Assessment

Use this to classify whether MCP usage is tightly controlled, drifting into shadow deployment, materially exposed, or already in an uncontrolled state.

Question 1 of 12 0% complete
Question 1 of 12

What this result should change

This section classify shadow MCP exposure quickly, surface the most significant gaps, and recommend an appropriate implementation path.

What this tool classifies as shadow MCP

Shadow MCP means unmanaged, local, containerized, unapproved, or weakly governed MCP usage that sits outside a defendable registry, ownership model, logging baseline, or disable path.

What a green result does not mean

A green result does not prove shadow usage is impossible. It means the current footprint appears more governable than the other states and still needs discipline to stay that way.

How to follow up on different results

ACT is one editable AI Controls Toolkit with eleven core files across eight workflow areas. It supports evidence collection and human decisions; it does not enforce controls or certify compliance.

Where to go next

When the assessment identifies control gaps, discuss the required scope and evidence with Move78. ACT includes an editable board oversight deck and written briefing, supported by intake, ownership, supplier and executive decision records. Your team gathers the evidence and records the next action.

ACT

Structure the visibility baseline, inventory, gap analysis, and dashboard layer for shadow MCP cleanup.

ACT

Move to the formal governance, evidence, incident, and implementation layer when shadow MCP is materially exposed or uncontrolled.

MCP Server Approval Gate

Use the approval-focused screen when the issue is vetting a proposed server rather than discovering unmanaged MCP usage.
This page is informational only. It does not provide legal advice, compliance certification, or an audit conclusion.

Frequently asked questions

What does this tool classify as shadow MCP?

It classifies unmanaged, local, containerized, unapproved, or weakly governed MCP usage that sits outside a defendable enterprise registry, ownership model, logging baseline, or disable path.

Does a green result mean shadow usage is impossible?

No. It means the current MCP footprint appears more governable than the other states. Drift can still emerge if visibility, registry discipline, or approval controls weaken.

Why are local and containerized deployments weighted so heavily?

Because they can spread faster than central governance, especially when teams run MCP locally, in containers, or through personal setups that bypass registry and ownership controls.

How should we act on different results?

ACT is one editable AI Controls Toolkit with eleven core files across eight workflow areas. It supports evidence collection and human decisions; it does not enforce controls or certify compliance.

Does this tool store anything I enter?

No. The assessment runs entirely in the browser. Answers are not stored, synced, or submitted to a server.

Source review dates are stated in the relevant guides. It provides operational implementation guidance and product information only; it is not legal advice, tax advice, audit assurance, certification assurance, conformity-assessment advice, buyer-approval assurance, or security assurance. Validate legal, regulatory, contractual, tax, audit, and security decisions with qualified professionals.