How do you govern third-party MCP servers and agent marketplaces?

Govern them as two things at once: a software supply chain dependency and a privileged identity. The supply chain half means provenance, version pinning, and review before use. The identity half means scoped credentials, least privilege, and monitoring, because an MCP server holds live tokens against real systems and its tool descriptions are instructions your agent will follow without question.

Run an allowlisted internal registry rather than permitting installation from public sources. Every entry gets reviewed once against a fixed checklist: who publishes it, what tools it exposes, what those tool descriptions actually say, what credentials it requires, whether it phones anywhere outside your allowlist, and whether the source is auditable.

Pin versions by hash. Floating versions reintroduce the review problem on every update, and the rug-pull pattern depends on exactly that: a server that behaves correctly through approval and changes its tool descriptions afterward.

Treat tool descriptions as code and diff them on every version change. A description is the highest-privilege text in the system, since it directly shapes agent behavior and no human reads it at runtime.

Scope credentials per server and per environment. The common failure is a single broad token issued during setup and never narrowed.

Marketplaces add discovery risk on top of all of this, because they optimize for installation speed and the review surface is a listing page.

Akto Atlas inventories connected MCP servers across the organization, including their tool surfaces and credential scopes, which is the prerequisite for any of these controls being enforced rather than documented.

An unreviewed MCP server is a dependency with a live token and write access to your agent's instructions.