Model Context Protocol (MCP) could cause unauthorized connections to AI models in your codebase. This article explains how.
Have you heard of what’s often called the USB port for AI applications? Gather round the campfire, it’s time for a modern-day ghost story. Model Context Protocol (MCP), introduced in 2024, is an emerging open standard that standardizes how AI models interact with external tools and data sources during runtime, beyond what was included in their training data. While MCP simplifies integration workflows, it also presents new security challenges that are quietly infiltrating modern software.
One challenge is shadow MCP, unauthorized or invisible connections to AI models embedded deep in your codebase. As MCP adoption accelerates, so does the risk of losing control over where, when, and how your application is connecting to external AI endpoints.
This article will walk developers and AppSec professionals through how to recognize, detect, and secure MCP usage across your software. Let’s uncover the ghosts hiding in your codebase, and get real about how to exorcise them once and for all.
Why You Might Already Be Haunted by Shadow MCP
You may be thinking, this doesn’t apply to me. After all, you haven’t consciously integrated OpenAI, Anthropic, or Hugging Face into your product. That’s where the word shadow comes in. Despite your intentions, AI APIs could still be running inside your application. How?
- Transitive dependencies could be pulling in model access libraries indirectly.
- Copy-pasted scripts or notebook snippets may have hardcoded calls to AI services.
- Configuration files could reference external models, often overlooked in code reviews.
In a similar way to how the term shadow IT represents unauthorized, unvetted, and unmonitored usage of IT solutions and tools, shadow MCP defines AI interfaces that are not under your control, or even your oversight. As we all know, you can’t secure what you can’t see — and when it comes to untracked model calls, this could end up leaking Personally Identifiable Information (PII), business logic, or even proprietary data.
See also: Taming AI Agent Sprawl in Industrial Organizations
What MCP Actually Is, and Why It’s in Your Code
Let’s take a step back and understand how MCP works as intended, supporting applications and services in interacting with external models or agents. MCP typically involves:
- Sending prompts or structured data to a model endpoint
- Receiving responses for interpretation or automation
- Potentially incorporating the model’s output directly into app functionality
As developers increasingly integrate AI functionality using SDKs and APIs, they see a lot of benefits. Perhaps the AI helps to boost productivity, adds natural language processing to their offering, or allows for agentic-orchestration of operational tasks or workflows. In some cases, they may not even realize they are adding MCP to their environment. A growing number of open source packages now come pre-integrated with MCP endpoints, which may bypass traditional security reviews.
See also: MCP: Enabling the Next Phase of Enterprise AI
Where Shadow MCP Hides: 4 Insertion Points in Your Codebase
To better understand where shadow MCP can enter your environment, here are four examples of where these kinds of ghostly entities hide out.
1. Direct SDK/API Use
The first example is with the developer’s eyes wide open. Many developers experiment with LLMs using popular APIs like OpenAI or LangChain. Even if these were only used for prototyping, they may have made their way into production via unchecked merges or legacy code paths.
2. Transitive Dependencies
Y’know that guy you invited to the party, who brought a friend without asking? That’s what’s happening here. A dependency of a dependency may be loading a model agent or an AI orchestration layer behind the scenes. Without a full dependency graph and an AI endpoint audit, these layers remain invisible.
3. Configuration Files
Now think beyond the code itself. YAML, TOML, or JSON config files often define model endpoints or keys that connect to external AI providers. These are easy to miss during code reviews and static analysis, but they still represent risk when it comes to shadow MCP.
4. Copied Scripts or Notebook Snippets
Developers often reuse code or snippets to save on rework and help meet crushing deadlines, but reused code from community notebooks or online tutorials can quietly embed LLM calls. Once pasted into internal tools or prototypes, these snippets may remain connected to unauthorized model APIs.
Secure Coding Practices to Surface Shadow MCP
To prevent Shadow MCP from becoming the poltergeist in your pipeline, teams must modernize their secure coding practices to include AI endpoint hygiene. Some examples include:
- Inventory MCP usage as part of your SBOM (Software Bill of Materials)
- Shift left to embed MCP security in the development lifecycle, with an emphasis on Software Composition Analysis (SCA).
- Static analysis tools scanning for known model interaction patterns (e.g., API calls, model loading)
- CI/CD policy enforcement to block unapproved AI endpoints or SDKs during code merges
- Developer education that raises awareness of risks from unchecked AI connectivity
Case-in-Point: OAuth Bypass via Hidden MCP Dependency
In one recent incident, a financial services team uncovered a critical flaw while auditing their application’s MCP usage. The issue stemmed from a transitive dependency that included a commonly used OAuth provider package, embedded within an MCP-integrated component. This outdated package contained a vulnerability that allowed token validation to be bypassed, opening the door to unauthorized access routes.
The vulnerability had gone undetected in standard code reviews and dependency scans. It was only after the team implemented the MCP visibility tooling that the unusual endpoint behavior was flagged and investigated. Without MCP visibility, the issue could have gone unnoticed until exploited.
Code Security Must Evolve for the AI Supply Chain
Delivering the perfect balance of rapid innovation and robust security is a continuously evolving challenge. As AI models and agents creep deeper into the software supply chain, legacy AppSec practices are no longer enough to cleanse against emerging threats.
Shadow MCP isn’t just a visibility gap; it’s a ghost lurking in SDKs, config files, and reused snippets. Left unchecked, it can quietly haunt your application with unauthorized data flow, compliance risks, and logic exposure. But with the right safeguards, this unwelcome visitor can be brought firmly into the light.
By embedding MCP security directly into the development lifecycle through shift-left practices with Mend.io, organizations can turn shadow MCP from an invisible spectre into a visible opportunity, empowering development teams to safely summon the benefits of AI integration while keeping security risks buried. Think of it like burning digital sage.
The era of AI is here to stay. Shadow MCP represents a new category of threat, blending the risks of supply chain sprawl, shadow IT, and agent unpredictability.
Let’s make sure your codebase isn’t haunted by what you can’t see, because some ghosts don’t just rattle chains, they exfiltrate data.
