Skip to lesson
Exit
Advanced agent configuration & MCP1 / 3

2 min lesson

Governing allowed MCP servers

Talk this through in your own words: "In one line, what does MCP actually do and why does that make it a governance concern?" Finish with the next move.

Step 1 of 3

Governing allowed MCP serversallowlists, not free-for-all

  • MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlist - admins specify which MCP servers are permitted org-wide. Developers can't wire in an arbitrary server that ships data to who-knows-where.
  • Scope per server - prefer read-only scopes for context-only servers like Confluence and docs. Reserve write and action scopes (creating Jira tickets, posting to Slack) for servers that genuinely need them.
  • Privacy posture - Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. and ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. govern what leaves to the model. An MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server is a separate data path you reason about on its own.
  • Audit - MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. calls are part of the activity you want logged, so you can answer 'what external systems did agents touch and when?'
MCP server review checklist (FDE)
Who hosts it?
First-party, vendor or community. Community servers get the most scrutiny.
Read or write?
Default to least scope and justify every write capability.
What data flows through?
Could it surface secrets, PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. or regulated data into context?
On the allowlist?
Not explicitly allowed by an admin means blocked. The allowlist is the control.

Run every proposed MCP server through this before it touches the org.

Worked example

A team proposes a community-hosted issue-tracker MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. that asks for write scope. Walk the four questions. Who hosts it? Community, so it earns the most scrutiny. Read or write? It requests write, but the team only needs to read ticket detail, so the write capability isn't justified. What data flows? Ticket bodies can pull customer PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. and internal detail into context. On the allowlist? No admin has approved it.

Verdict: blocked. It goes live only after an admin adds it to the allowlist and the scope is downgraded to read-only. Start at least scope; widen later if a real write need shows up.