Your developers already installed MCP servers. Do you know what they run?

MCP is stuck between the laptop and production. Security is the reason.

Engineers adopted MCP faster than anyone could govern it. In Stacklok's July 2026 survey of enterprise engineers, 86% of MCP use is still experimentation or local development, only 5% run governed, enterprise-wide production, and 49% name security and compliance as their biggest blocker. OWASP now lists tool poisoning (MCP03) and shadow MCP servers (MCP09) in its MCP Top 10.

The problem underneath is simple: a team approves a server by its name, and the code behind that name keeps moving. Here is what our signed scan of the whole registry found this week.

Figures: our daily signed scan of 42,172 servers in the official MCP registry, 12 October 2026 (live numbers). Survey: Stacklok, State of MCP in Software 2026, 100 senior engineers at US and UK enterprises. OWASP MCP Top 10.

Check it. Pin it. Gate it. Prove it.

One signed verdict per server, the same everywhere your people make a decision: in the chat window, in the pull request, at launch, and in front of an auditor.

1. CheckAsk ChatGPT or Claude through the Redthread connector, open a verify page, or run atpp check-config against the servers already in your Claude, Cursor or VS Code config. Your config never leaves your machine.
2. PinEvery claim names the exact npm, PyPI or container digest that was scanned and the repository that built it, so you can pin what you run to what was checked.
3. Gate previewatpp gate allows or denies a launch: in CI on every pull request, or in front of ToolHive. Your allow-list and egress policy become a ToolHive permission profile.
4. ProveSigned in-toto claims, a daily manifest anchored in Sigstore Rekor and committed to a public log, co-signed keyless. Anyone can verify offline, including your auditor.

One signed answer, three people who need it

What it covers, and what it does not

Evidence your identity provider can act on

Identity providers such as Okta, Microsoft Entra and CrowdStrike decide who an agent is and what it may do. Keep them. What they don't produce is evidence someone else can check: a signed record of what the agent actually did, and whether it is still the agent you approved. ATPP adds that record alongside your identity provider, and its signals can feed the decisions your gateway makes. Attestation vs. authorisation.

Four questions you can't answer about your agents right now

None of these are hypothetical. They're the questions that arrive in an incident channel at 11pm, or in an enterprise security questionnaire on a Tuesday — and today the honest answer to all four is a shrug.

Same agent. Same permissions. One of them can prove itself.

Agentic Trust & Protection Platform doesn't slow your agents down or route their traffic through us. It doesn't replace your identity provider either. It changes what exists after they act — and for teams who want more than a record, ATPP Enforce adds an inline checkpoint, opt-in and gated (see below).

Four steps from "we think it's fine" to "here's the proof"

No framework rewrite, no gateway to route traffic through. Agentic Trust & Protection Platform sits beside the agents you already run.

1. Register the agent
   Point Agentic Trust & Protection Platform at a LangGraph, CrewAI, AutoGen, or custom agent process. Container, Lambda, or laptop — it doesn't matter where it runs.
2. Issue an identity
   Use the identity your provider already issues, or, if you don't have one for agents yet, each agent gets a unique spiffe:// identity and a short-lived signed certificate. Not a key in an env var — an identity that rotates and can't be replayed.
3. Broadcast signed state
   Every tool call, scope request, and data access is signed and streamed as a trust-state event. This is the audit trail nobody had time to build.
4. The badge goes live
   green while the agent operates inside its granted scope. red the moment it doesn't — an escalation attempt, an out-of-scope read, or a tool it was never issued.

One mark. Binary meaning. Anyone can check it.

Every other product in this category gives you a console your security team logs into. This gives you something you can hand to a customer.

Every badge links to a verify page. The document behind it is Ed25519-signed with the workspace key, published at a stable URL — anyone can check the signature offline without calling us. Unknown or expired renders grey. Red only on a proven exploit or a signed out-of-scope action.

Seven rules that make the badge worth checking

Badges are easy to launch and hard to make anyone check. These are the rules the product enforces — each one is verifiable by a skeptical engineer, and none of them can be bought.

The badge went from a record to a checkpoint.

Everything above happens after an agent acts. ATPP Enforce puts a decision point in front of the request — a gateway your agent's traffic runs through, checked against a grant you write, before anything reaches its destination.

You cannot switch on blocking by accident.

Every new grant starts in shadow — it decides and records, and forwards everything, exactly like the recording layer above. There is no setting that puts a fresh identity straight into blocking traffic.

This is a preview: the whole point of a checkpoint is that it has to earn the traffic it blocks, so we are not shipping one that hasn't. Ask about early access →

Land it in an afternoon, not a procurement cycle

You shouldn't need a signed MSA to find out whether your agent is behaving. Talk to us when you need SSO, long-term log retention, or a few hundred agents — not before.

Billed monthly, or yearly at 20% off. Start free, then choose Team or Business under Settings → Billing in the app. Items marked planned are not available yet and are not part of what you are buying today.

Everyone sells control. Nobody sells proof.

Agent and non-human identity is a real, funded category — three of its fastest-growing names were acquired into larger platforms during 2026. Here's how the independents present themselves, and where we think the gap is.

Public marketing copy as published September–October 2026. Vendors iterate quickly and several of these are excellent products — if you're running a large enterprise identity program, some of them are a better fit than we are. Verify current details directly before you decide.