Inventory the server
Track owner, environment, host, exposed tools, upstream system, credential type, write capability, and whether the server is approved for production agent use.
RESOURCE / MCP SERVER DIRECTORY
MCP Server Directory for Enterprise AI Teams
Known tool connectors, ranked by credential exposure and governance priority.
MCP servers make agents useful by connecting them to databases, SaaS systems, browsers, repositories, cloud control planes, and internal tools. They also expand the blast radius of agent access. This directory helps security and platform teams decide which servers need the strongest review before production use.
MODEL CONTEXT PROTOCOL / GOVERNANCE
The server list is useful. The access model is what matters.
MCP adoption creates a new integration layer between agents and enterprise systems. Treat every server as a privileged connector with its own credentials, permissions, data access, and runtime audit requirements.
Constrain credentials
Prefer short-lived tokens, read-only roles, narrow OAuth scopes, project allowlists, and separate credentials for development, staging, and production agents.
Record tool access
Log tool name, arguments, resource IDs, retrieved documents, write operations, actor, model route, and final outcome so security teams can reconstruct activity.
Govern model calls
Keep LLM provider traffic behind an on-prem gateway with virtual keys, budgets, guardrails, and durable audit while tool-specific permissions stay scoped at the source system.
CURATED MCP SERVER LIST
Popular MCP servers by enterprise risk surface
Use this as a starting inventory. Confirm each server implementation, version, OAuth scope, and deployment model before approving it for production use.
Data & Storage
Databases, warehouses, files, and operational records that often contain regulated data.
07 SERVERSServerSystemCredential SurfaceRiskRecommended Control
Database user, host allowlist, schema grantsCriticalUse read-only roles, query allowlists, row-level security, and full query logging.Database user, network path, table grantsCriticalSeparate production credentials, restrict write operations, and rotate exposed secrets.Google service account, dataset IAM, billing projectCriticalBind service accounts to approved datasets and monitor query cost per agent workflow.User, role, warehouse, network policyCriticalUse least-privilege roles, masking policies, warehouse quotas, and query audit exports.Project token, service role key, database roleHighAvoid service-role keys in agents and enforce row-level security for all agent paths.OAuth scopes, domain delegation, shared-drive permissionsHighConstrain OAuth scopes, isolate service accounts, and log file IDs returned to agents.OAuth app, enterprise token, folder permissionsHighLimit folder scope and require approval before agents access customer or legal records.Cloud & Infrastructure
Cloud, cluster, deployment, and runtime systems where MCP tool access can affect production assets.
05 SERVERSServerSystemCredential SurfaceRiskRecommended Control
IAM role, access key, STS session, resource policyCriticalPrefer short-lived roles, deny destructive APIs by default, and stream CloudTrail evidence.Managed identity, app registration, RBAC assignmentCriticalScope app registrations tightly and alert on privileged role assignment or secret creation.API token, account scope, zone permissionHighUse account-scoped tokens with read-only defaults and approvals for DNS or deploy actions.Kubeconfig, service account, RBAC bindingCriticalBind read-only roles by namespace and block exec, secret read, and mutating verbs unless approved.Workspace token, cloud backend, provider credentialsHighSeparate plan from apply and keep state access away from broad agent prompts.Development Tools
Code, CI/CD, observability, and security platforms used by engineering and platform teams.
09 SERVERSServerSystemCredential SurfaceRiskRecommended Control
OAuth app, GitHub App token, PAT, repository permissionCriticalPrefer GitHub Apps, repository allowlists, branch protections, and audit every write action.Project token, group token, OAuth app, CI permissionsCriticalConstrain project scope, separate read and write tokens, and block pipeline mutation by default.Local repository path, SSH key, filesystem accessHighRun in a sandboxed workspace and prevent arbitrary filesystem traversal.API key, application key, site, org roleHighUse read-scoped apps and prevent agents from muting monitors or changing incident routing.Service account token, data-source permissionsHighScope service accounts by folder and data source; log query text and panel access.Organization token, project token, issue permissionMediumRestrict project scope and redact PII in stack traces before agent retrieval.Organization token, project permissionMediumAllow read-only finding access and route remediation changes through pull requests.API key, workspace role, environment secretsHighPrevent environment secret exposure and separate collection read from execution privileges.Team token, project scope, deployment permissionHighKeep deployment tokens read-only unless change control approves release actions.Content & Search
Web, browser, crawler, documentation, and search tools that expand what agents can retrieve.
06 SERVERSServerSystemCredential SurfaceRiskRecommended Control
API key, query quota, usage billingMediumLog query terms and keep search output outside trusted data boundaries until validated.Outbound network access, URL allowlistMediumApply domain allowlists, malware scanning, and prompt-injection filtering on retrieved text.API key, crawl quota, outbound domainsMediumRestrict crawl domains and retain provenance for every retrieved page.Browser session, cookies, filesystem, networkCriticalRun isolated browsers, block credential reuse, and record screenshots plus network traces.Browser session, cookies, filesystem, networkCriticalUse disposable profiles, outbound allowlists, and strict download/upload restrictions.API key, quota, project billingLowRestrict API keys by referrer or service account and monitor quota consumption.Productivity & SaaS
Collaboration systems where agent access can expose conversations, tickets, docs, and CRM data.
06 SERVERSServerSystemCredential SurfaceRiskRecommended Control
OAuth scopes, API token, project and space permissionHighLimit Jira projects and Confluence spaces; require approval for writes or status changes.Bot token, user token, channel membership, OAuth scopesHighRestrict channels, redact sensitive messages, and separate read bots from posting bots.Integration token, page and database permissionsMediumShare only approved pages with the integration and avoid workspace-wide access.OAuth app, API key, workspace permissionMediumSeparate issue read access from mutation and log every generated comment or status change.OAuth app, workspace permission, project membershipMediumConstrain projects and route task creation or assignment through approval flows.Private app token, OAuth scopes, object permissionsHighMinimize CRM object scopes and redact customer PII before passing context to models.AI & Memory
Model, vector, memory, and retrieval systems that shape agent context and long-lived recall.
04 SERVERSServerSystemCredential SurfaceRiskRecommended Control
Access token, organization permission, gated model accessMediumSeparate public model discovery from organization tokens and gated asset access.API key, collection permission, network endpointHighPartition collections by tenant and log every vector query plus document ID returned.API key, index permission, data source connectorHighSeparate indexing credentials from retrieval credentials and review source permissions.Local store, database token, user profile dataHighExpire memory records, classify stored facts, and block regulated data from persistence.Business Systems
Payments, support, and workflow systems where tool calls can read or mutate customer operations.
04 SERVERSServerSystemCredential SurfaceRiskRecommended Control
Restricted key, webhook secret, account permissionCriticalUse restricted read keys and require explicit approval for refunds, disputes, or price changes.Access token, workspace permission, conversation scopeHighRedact customer data and separate read-only context from outbound message generation.OAuth app, connected app policy, object permissionsCriticalConstrain object permissions, require field-level security, and monitor bulk export attempts.API token, board permission, workspace accessMediumScope tokens by board and require review before agents create automations or change owners.ENTERPRISE REFERENCE ARCHITECTURE
Keep MCP tool access and LLM provider access governed as separate control planes.
MCP servers authorize tools and data sources. Agent Access Manager governs LLM provider access through virtual keys, routing, budgets, guardrails, metering, and audit. Separating these paths gives platform teams clearer evidence and fewer shared secrets.
01Agent applicationuses MCP tools + virtual LLM key
02MCP serverscoped to source-system credential
03Agent Access Managerroutes model call through /v1/chat/completions
04Audit planerecords tool evidence + model usage outcome
MCP ACCESS REVIEW
Prioritize the MCP servers that can touch regulated data or production systems.
Review your current MCP server inventory, model-provider keys, data boundaries, and audit requirements with an enterprise AI gateway architecture session.
Request enterprise review →Recommended for CISO, CTO, platform, and AppSec teams