MCP entering enterprise security & enforcement phase

1. Cloudflare One Gateway MCP detection/enforcement GA — `experimental.is_mcp`, Portal-only enforcement, OAuth pre-registration (2026-08-14, primary source, ev-20260814-03)
2. Workday Adaptive Planning first-party MCP Server in 2026R2 release notes (2026-08-14, official docs) — enterprise SaaS supply side
3. Practical DevSecOps MCP Security Statistics 2026: 82% of implementations are vulnerable to path traversal; 40+ MCP CVEs disclosed by early August — security demand side
4. Ecosystem scale: 10,000+ MCP servers after the 2026-07-28 stateless spec revision
5. Background (verified): Netskope's MCP Security Dashboard in Advanced Analytics became available to all customers with Advanced Analytics enabled on 2026-06-12 (official release notes); however, the 22 MCP data attributes remain behind a feature flag (Sales/Support activation) — not a clean GA (verified 2026-08-20 as pre-coverage background)
6. Background (verified): Netskope Release 140.0.0 (monthly update posted 2026-08-11, pre-coverage) ships Agentic Broker, which applies real-time protection policies to MCP traffic from a dedicated RTP page, scoped per server, per catalog category, or across any MCP traffic, and extends MCP activity visibility in SkopeIT. This is a second vendor's enforcement capability, but it is pre-coverage background, the 22 MCP data attributes remain behind a feature flag, and there is no public telemetry (verified 2026-08-22)
7. Background (verified): Zscaler announced Zscaler AI Broker on 2026-06-09 (Zenith Live), a security broker for agent communication over MCP and A2A, paired with an Agent Registry that shows, per agent, which resources it is authorized to access — part of its Zero Trust platform for Agentic AI. This is the third SSE/security vendor with an MCP enforcement capability after Cloudflare and Netskope, but the press release does not state GA vs. preview status and there is no public telemetry (verified 2026-08-24 as pre-coverage background; the 8/17 check missed it)
8. Background (verified): Netskope's 2026-03-11 press release announced the Netskope One AI Security suite (incl. Agentic Broker — visibility and control over all MCP transactions, sanctioned or not) as "generally available today", meaning the Broker product itself has been GA since March; however the 22 MCP data attributes remain behind a feature flag with no public telemetry (verified 2026-08-29 as pre-coverage background)
9. Netskope Release 141 (notes page dated 9/1, not yet published at the 9/2 check, captured this window, verified against official docs): AI Command Center's Endpoint AI Discovery (beta) discovers AI agents, browser/editor/desktop extensions and local models on managed endpoints via the Netskope Client, with beta discovery of MCP servers used on endpoints; AI Guardrails On Demand - Netskope Hosted reached GA (standalone REST API integrating with LiteLLM/Kong/Apigee gateways); AI Gateway x Enterprise Browser integration (beta, centralized governance of browser-originated LLM traffic plus an emergency kill switch via gateway token revocation). The enforcement surface extends from network traffic to endpoints and the browser — but Endpoint Discovery is beta and gated behind rep/support enablement; the 22 MCP data attributes are still not mentioned as leaving the feature flag, and there is no public telemetry (verified 2026-09-05)
10. The 'Scanning the Harness' supply-chain audit (2026-09-10, arXiv 2609.07360, ev-20260910-08): 16.0% of 3,171 public GitHub repositories (2,600 Claude Code/Cursor/Copilot/Codex configs + 511 published skill sets) carry at least one security defect — 9.8% install unpinned MCP servers, 3.1% pre-approve arbitrary execution behind scoped-looking grants, and 3.8% of skills carry pre-approved shells; every finding was independently re-derived and dual-adjudicated, with tools, corpus manifest and adjudications released — the first quantified audit of the MCP/skills config supply chain and the first independent academic measurement on the security-demand side (verified 2026-09-11)
11. LiteLLM 1.102.0 stable (2026-09-20, ev-20260913-01 update): Agent Skills discovery, per-user MCP tool authorization, customer-managed KMS and routing telemetry reach a stable gateway build; this makes the control plane trialable but remains one project without an interoperable auth/enforcement specification
12. Google Cloud API Gateway MCP (September 24, 2026, ev-20260924-08): existing REST APIs become MCP tools while reusing JWT, quotas and logs; unauthenticated-by-default `tools/list` shows that enterprise discovery still needs explicit policy
13. Codex 0.158.0 stable (September 28, 2026, ev-20260818-02 update): pre-registered MCP OAuth clients can provide client secrets, bringing enterprise identity integration into a stable client.
14. LiteLLM 1.103.0 stable (September 28, 2026, ev-20260913-01 update): adds RFC 8693 token exchange, MCP client allowlists, live-session inspection and forced credential revocation.

Review log

1. 2026-08-17 · Checked whether Zscaler/Netskope/Palo Alto ship MCP identification — none found (only SASE comparison articles and Zscaler's own MCP server integrations). The confirmation criterion remains unmet. Status/Confidence unchanged.
2. 2026-08-18 · Background note: Netskope's MCP security capabilities (real-time MCP server/client identification with name/ID/URL/version/host/protocol attributes, CCI risk scoring, default-block policy, DLP) were announced as Preview on 2025-12-01, with GA planned for H1 2026; no dated GA announcement found. On capability this partially meets the second-vendor criterion, but it predates KB coverage and is logged as background only. Additional context: the 2026-07-28 MCP auth spec (OAuth 2.1/OIDC) met enterprise pushback (anonymous DCR criticism); CSA catalogued ~7,000 exposed MCP servers in early 2026, roughly half unauthenticated; NSA/DoD issued security design guidance in June 2026. Criterion refined to: a second security vendor shipping **GA** MCP identification plus published telemetry. Status/Confidence unchanged.
3. 2026-08-19 · No new in-window signals; the Netskope GA criterion remains unmet (the press-release page was unreachable this run; no dated GA announcement found). Adjacent signal (not counted as evidence): Codex 0.148.0's MCP recovery after OAuth re-auth and sandbox fail-closed are client-side reliability hardening, not enterprise identification or enforcement. Status/Confidence unchanged.
4. 2026-08-20 · Substantive criterion progress: Netskope's official release notes (2026-06-12) confirm the MCP Security Dashboard is available to all customers with Advanced Analytics enabled (a dashboard for monitoring AI-agent activity), but the 22 MCP data attributes still require a feature flag plus Sales/Support activation. Conclusion: partial GA, not a clean GA; the confirmation criterion (second-vendor GA plus public telemetry) remains unmet. The fact predates KB coverage and is recorded in the evidence list as verified background. No other in-window signals. Status/Confidence stays emerging / Medium.
5. 2026-08-21 · No new in-window signals; the Netskope clean-GA criterion remains unmet (no dated GA announcement found; the 2026-06-12 partial-GA state stands). Adjacent signals (not counted as evidence): Claude Code 2.1.238's stdio MCP handshake-order fix (server/discover no longer precedes initialize) and elicitation-dialog fixes are client-side reliability work; Tencent/AI-Infra-Guard (an agent/MCP/skills scanning red-team tool) trending on GitHub is a community-tool signal. Status/Confidence stays emerging / Medium.
6. 2026-08-22 · Verified-background progress: Netskope 140.0.0's Agentic Broker (8/11, pre-coverage) enforces real-time policies on MCP traffic — a second vendor's enforcement capability after Cloudflare, now recorded as evidence item 6. The clean-GA criterion remains unmet: the August monthly update does not mention the 22 MCP data attributes leaving the feature flag, and there is no public telemetry. No other in-window signals. Status/Confidence stays emerging / Medium.
7. 2026-08-24 · One new verified-background evidence item (item 7): Zscaler AI Broker (6/9, pre-coverage) is a third vendor's MCP/A2A enforcement capability, plus an Agent Registry. The press release does not state GA status and there is no public telemetry, so the clean-GA criterion (second-vendor GA plus public telemetry) remains unmet; on the Netskope side, the August monthly update says nothing about the 22 MCP data attributes leaving the feature flag. No other in-window signals. Status/Confidence stays emerging / Medium.
8. 2026-08-28 · No in-window signals. Re-checks: Netskope's official release notes still stop at 140.0.0 (checked 8/28) — the 22 MCP data attributes remain behind the feature flag with no public telemetry; the MCP-gateway wording in Zscaler's 2026-01-27 press release verified as earlier pre-coverage background (same organization as evidence item 7 and older, not counted again). The clean-GA criterion (second-vendor GA plus public telemetry) remains unmet. Status/Confidence stays emerging / Medium.
9. 2026-08-29 · No new signals in-window. Review: Netskope official release notes still at 140.0.0 (no 141.x found); the 22 MCP data attributes remain behind the feature flag. One newly verified pre-coverage background fact registered — the 2026-03-11 press release confirms the Agentic Broker product has been GA since March (evidence item 8) — but the clean-GA criterion (attributes out of flag + public telemetry) remains unmet. Status/Confidence stay emerging / Medium.
10. 2026-08-30 · No new signals in-window. Re-check: Netskope official release notes still stop at 140.0.0 (verified via search 2026-08-30, no 141.x found); the 22 MCP data attributes remain behind the feature flag with no public telemetry; no Zscaler GA announcement. The clean-GA criterion (second-vendor GA + public telemetry) remains unmet. Status/Confidence stay emerging / Medium.
11. 2026-08-31 · No new signals in-window, plus one factual correction: Netskope's release line actually reached 140.1.0 (a hotfix published 2026-08-17, verified against official release notes — prior runs' 'still stops at 140.0.0' was wrong), but its content is device-deletion GA and an IPSec/GRE site-page revamp only, with no MCP content at all; the 22 MCP data attributes remain behind the feature flag with no public telemetry, no 141.x found; no Zscaler GA announcement. The clean-GA criterion (second-vendor GA plus public telemetry) remains unmet. Status/Confidence stay emerging / Medium.
12. 2026-09-02 · No new signals in-window. Review: Netskope Release 141 is rolling out (a trust.netskope.com maintenance notice confirms R141 upgrades underway; the docs.netskope.com 141.0.0 release-notes page is not published yet; engine maintenance under R141 noted in the 140.0.0 notes is expected to complete by 2026-12-31); the 22 MCP data attributes remain behind the feature flag with no public telemetry; no Zscaler GA announcement. The clean-GA criterion (second-vendor GA plus public telemetry) remains unmet. Status/Confidence stay emerging / Medium.
13. 2026-09-05 · New in-window evidence: R141 notes published (new evidence item 9) — the enforcement surface extends to endpoints and the browser (Endpoint AI Discovery discovering MCP servers/AI agents; the AI Gateway x Enterprise Browser kill switch), another granularity advance after Cloudflare / Netskope Broker / Zscaler. The clean-GA criterion (GA MCP identification plus public telemetry) remains unmet: Endpoint Discovery is beta with gated enablement, and the 22 MCP data attributes have not left the flag. Adjacent signal (not counted): Claude Code 2.1.259's managedMcpServers brings org-managed MCP server distribution to the client side. Stays emerging / Medium.
14. 2026-09-08 · No new signals in-window (weekend). Review: Netskope's official release notes still stop at 141.0.0 (no 142.x found); the 22 MCP data attributes remain behind the feature flag with no public telemetry; no Zscaler GA announcement. The clean-GA criterion (second-vendor GA plus public telemetry) remains unmet. Stays emerging / Medium.
15. 2026-09-12 · No new signals in window (9/8-9/11). Re-check: Netskope release notes still at 141.0.0 (no 142.x; the 141 page's currently visible highlight is an SSPM update), 22 MCP data attributes still behind the feature flag with no public telemetry; no Zscaler GA. Adjacent (not counted): Gemini CLI 0.59.0 stable's fail-closed workspace trust + mcpServers filtering in restricted mode is client-side hardening; the Agents API's native MCP support is a platform-side adoption signal. Clean-GA criterion still unmet. Maintained emerging / Medium.
16. 2026-09-12 · Reconciliation pass: evidence item 10 added ('Scanning the Harness' — the first quantified audit of the MCP/skills config supply chain, 16% defect rate). Review: Netskope's official release notes still stop at 141.0.0 (no 141.x hotfix or 142.x found); the 22 MCP data attributes remain behind the feature flag with no public telemetry; no Zscaler GA announcement. Adjacent signal (not counted): GitHub Copilot's enterprise agent-operations permissions GA (ev-20260909-02) brings block/ask/allow governance to the client side. The clean-GA criterion remains unmet; stays emerging / Medium.
17. 2026-09-12 · 02:08Z follow-up scan: no new enterprise MCP-enforcement GA or public telemetry. Adjacent signal (not counted): Gemini CLI 0.61.0 nightly blocks indirect prompt injection through build-file changes and untrusted flags and hardens sandbox filesystem boundaries; it remains pre-release. Stays emerging / Medium.
18. 2026-09-13 · No new signals in-window. Re-check: Netskope's official release notes still stop at 141.0.0 (no 142.x found); the 22 MCP data attributes remain behind the feature flag with no public telemetry; no Zscaler GA announcement. Adjacent signal (not counted): the rubyhack.ai disclosure of an agent attack on a package registry is a new shape on the security-demand side, but not enterprise MCP enforcement. The clean-GA criterion remains unmet. Stays emerging / Medium.
19. 2026-09-13 · 01:02Z follow-up scan: no new enterprise MCP-enforcement GA, public telemetry or comparable Zscaler delivery. Stays emerging / Medium.
20. 2026-09-14 · The LiteLLM RC adds per-user MCP tool permissions, but this is a prerelease gateway capability rather than security-vendor GA or public telemetry, so it is not counted as formal evidence. Stays emerging / Medium.
21. 2026-09-15 · The OATS audit of 66,192 skills and live gate experiment shows static scanning needs runtime consequence control. It covers general skill/shell policy rather than a new MCP-enforcement GA or public telemetry, so it is counted under trend #7 and not double-counted here. Stays emerging / Medium.
22. 2026-09-16 · No independent in-window evidence changed the confirmation criteria. Status and confidence stay unchanged.
23. 2026-09-17 · Gemini CLI 0.60 moves MCP OAuth issuer checks and path-boundary fixes into stable, but this is client hardening rather than a second security vendor's GA MCP detection with telemetry. Stays emerging / Medium.
24. 2026-09-18 · Codex MCP user verification, GitHub MCP adoption telemetry and the UN Data Commons connector broaden identity and observability, but a second security vendor's GA detection product and an interoperable auth spec are still missing. Stays emerging / Medium.
25. 2026-09-19 · Pydantic AI 2.45 reuses MCP sessions within durable runs and Claude Code tightens gateway egress, improving runtime reliability without adding a cross-vendor auth or enforcement specification. Stays emerging / Medium.
26. 2026-09-20 · Pydantic AI 2.46 adds Temporal agent event streams, but no new MCP auth/enforcement specification, second-vendor public telemetry or independent adoption data appeared. Stays emerging / Medium.
27. 2026-09-21 · LiteLLM 1.102.0 moves per-user MCP tool permissions and Skills discovery into stable, clearing the earlier trial gate. A cross-vendor auth/enforcement specification and second-vendor public telemetry are still missing. Stays emerging / Medium.
28. 2026-09-22 · No new cross-vendor auth/enforcement specification, GA security product or public adoption data appeared. Stays emerging / Medium.
29. 2026-09-23 · No new cross-vendor auth/enforcement specification, GA security product or public adoption data appeared. Stays emerging / Medium.
30. 2026-09-25 · GitHub JetBrains adds persistent per-MCP-tool controls, but no cross-vendor auth/enforcement specification or independent adoption data appeared. Stays emerging / Medium.
31. 2026-09-26 · Google API Gateway brings existing authentication, quotas and logs into MCP, while GitHub's default policy includes MCP-server policy; a cross-vendor auth/enforcement schema is still missing. Stays emerging / Medium.
32. 2026-09-27 · Claude Code 2.1.283 improves MCP progress, transient-404 recovery and organization-blocked visibility, but this is one client reliability update rather than a shared cross-vendor authorization schema. Stays emerging / Medium.
33. 2026-09-27 · The follow-up scan found no new independent signal sufficient to change this trend. Status and confidence are unchanged; the GPT-6 image-encoding fix is an engineering update to an existing release.
34. 2026-09-27 · This scan found no new independent signal sufficient to change the assessment. Status and confidence remain unchanged.
35. 2026-09-28 · Codex 0.158.0 supports client secrets for pre-registered MCP OAuth clients; LiteLLM 1.103.0 adds RFC 8693 token exchange, client allowlists and live-session revocation. Enterprise identity and session governance continue entering stable products, but cross-vendor schemas and public production telemetry remain absent. Stays emerging / Medium.
36. 2026-09-29 · MCP TypeScript SDK 2.2.0 validates issuers before token requests and auto-paginates list calls; Claude Code 2.1.284 also adds private_key_jwt IdP authentication and bulk MCP reconnect. Enterprise identity and recovery keep improving, but cross-vendor schemas and public production telemetry remain absent. Stays emerging / Medium.
37. 2026-10-02 · No new signals changed the status or confidence in this run.
38. 2026-10-03 · No new signals changed the status or confidence in this run.
39. 2026-10-04 · MCP TypeScript and Python SDK 2.3 tighten redirects, token audiences, connection lifecycles and SSE payload limits; this adds SDK-level evidence to the existing governance trend without changing status or confidence.
40. 2026-10-05 · LiteLLM 1.104 further hardens MCP gateway identity, routing and accounting, while Figma hosted MCP shows a product-access layer can sit above an open protocol. Status and confidence are unchanged.
41. 2026-10-06 · MCP TypeScript SDK 2.3.1 is a compatibility patch; no signal in this cycle changes status or confidence.
42. 2026-10-07 · No new signal in this cycle was strong enough to change status or confidence.
43. 2026-10-08 · No new signal was strong enough to change status or confidence.
44. 2026-10-09 · LiteLLM 1.104.2 brings the Decisions API into the stable gateway, but this remains one implementation update; status unchanged.
45. 2026-10-09 · No new cross-vendor MCP enterprise-governance signal appeared; status unchanged.
46. 2026-10-14 · No new cross-vendor MCP enterprise-governance signal appeared; status unchanged.
47. 2026-10-10 · No new cross-vendor MCP enterprise-governance signal appeared; status unchanged.
48. 2026-10-12 · LiteLLM 1.105 adds MCP protocol/capability discovery, caller authorization and retrieved-chunk guardrails; it is one gateway signal, so status is unchanged.
49. 2026-10-12 · No new cross-vendor MCP enterprise-governance signal appeared; status unchanged.
50. 2026-10-14 · Run:ai ships an MCP server and Claude Code fixes policy-check ordering for blocked MCP servers; evidence remains concentrated in existing vendors, so status is unchanged.
51. 2026-10-16 · No new MCP enterprise-security or enforcement evidence appeared; status unchanged.
52. 2026-10-16 · No new evidence in this run changes the status.
53. 2026-10-17 · No new signal in this run was strong enough to change status.
54. 2026-10-18 · LiteLLM 1.106 disables stdio MCP by default and strengthens issuer and credential isolation; stays emerging / Medium.
55. 2026-10-20 · No new MCP security signal changed the status this run.
56. 2026-10-21 · No new MCP security signal changed the status this run.
57. 2026-10-21 · LiteLLM 1.107 strengthens MCP bearer and OAuth paths without changing the enterprise MCP trend status.
58. 2026-10-23 · No new signal in this run changed status or confidence.
59. 2026-10-24 · No signal in this run changes status or confidence.
60. 2026-10-24 · MCP TypeScript SDK 2.4 adds Skills verification and stricter schema/header handling; LiteLLM key rotation adds a deployment-policy migration signal.
61. 2026-10-25 · No new evidence in this run changed the trend stage.
62. 2026-10-27 · No new evidence in this run changed the trend stage.
63. 2026-10-27 · No new independent signal in this run changes status or confidence.
64. 2026-10-28 · GitHub workload identity and Gemini CLI private-network MCP OAuth add identity-boundary signals, but cross-product deployment evidence remains limited; status stays emerging.
65. 2026-10-30 · Copilot carries enterprise permissions and MCP allowlists forward, but no new cross-product MCP governance deployment appeared; status is unchanged.
66. 2026-10-31 · No new cross-product enterprise MCP governance deployment appeared; status is unchanged.
67. 2026-10-31 · No new signal in this run changes the current trend judgment.
68. 2026-11-02 · No new signal in this run changes the current trend judgment.
69. 2026-11-03 · No new signal in this run changes the current trend judgment.