MCP Governance — Inventory & Control MCP Traffic

The problem

Every agent ships its own integration layer

Local config sprawl — servers configured per-user in local dotfiles, outside any central registry or review.
Plaintext credentials — tokens and keys sitting in agent config files; one rewrite redirects authenticated traffic.
Arbitrary process spawn — local stdio servers run whatever they're pointed at, as the logged-in user.
Look-alike servers — a familiar name in a registry is not an identity; rogue servers ride typosquats and clones.

Command injection — stdio command-injection issues across official MCP SDKs.
Config rewrites — malicious npm packages observed rewriting agent config files post-install.
Credential theft — plaintext keys in dotfiles harvested by infostealers built for the agent era.

How it works

Discover

Every server configured on every machine — mapped to the agents that load it and the accounts that run it.

Monitor

Tool-call traffic inspected in flight — which tools, which payloads, which data left the device.

Enforce

Per-agent allow-lists — rogue and look-alike servers surfaced and blocked; sanctioned ones scoped to the agents that need them.

Replay

Every call logged and replayable — the audit trail for the integration layer nothing else records.

Network tools see TLS. SaaS logs see the tenant. Only the endpoint sees which agent called which MCP tool with what — that's where Ospiri sits.