Find shadow MCP servers

Shadow AI is shadow IT for agents: developers installing and configuring MCP servers on their own machines, without review or approval. Any developer can add one from a GitHub repository, an npm package or a URL. There is no approval flow, no security scan and no record afterwards.

Danger

A misconfigured or malicious MCP server can send code, credentials or proprietary data back out through a tool response. The agent cannot tell the difference. It called a tool and got a result.

Where they hide

Every AI client keeps its MCP configuration in its own file:

Client	Config
Claude Desktop	`~/Library/Application Support/Claude/claude_desktop_config.json`
Claude Code	`~/.claude/settings.json`
Cursor	`~/.cursor/mcp.json`
VS Code	`~/.vscode/settings.json`

Scanning

The mcphub CLI reads every known location and checks what it finds against the servers your organization has approved.

$ mcphub scan
Scanning MCP configurations...

Claude Desktop (claude_desktop_config.json)
  ok  stripe-mcp          -> statio (approved)
  ok  github-mcp          -> statio (approved)
  !   random-npm-mcp      -> npx (unauthorized)
  !   local-file-server   -> stdio (unauthorized)

Cursor (.cursor/mcp.json)
  ok  statio-gateway      -> https://gateway.statio.dev (approved)
  !   sketch-to-code      -> npx (unauthorized)

Summary: 3 approved, 3 unauthorized
Run 'mcphub report' to submit to your organization.

Each discovered server is checked against the organization's registry, and anything unrecognised is flagged with its name, transport, command and source. mcphub report submits the result to the organization dashboard.

Why it works without an endpoint agent

Most shadow-AI discovery reads an endpoint-security or device-management system you already run: CrowdStrike, Intune, Jamf. If you do not have one, and most teams under a few hundred people do not, those tools see nothing.

mcphub is developer-installed instead. The developer opts in by authenticating with their organization, which means:

no MDM infrastructure to deploy first
it runs on macOS, Linux and Windows alike
developers control when a scan runs, rather than IT running it remotely
it is already there, because mcphub writes the MCP config in the first place
admins get aggregate visibility without device-level surveillance

What the organization sees

Submitted reports aggregate into the dashboard: the total across all machines, the approved and unauthorized split, which unauthorized servers are spreading, per-developer status, and an alert when a new one appears.