# Shadow MCP detection

**Shadow MCP** — MCP servers or tool endpoints that agents use without platform approval — is a primary ASI04 gap in enterprise agent rollouts.

Blekline detects shadow MCP in two complementary paths:

## 1. Runtime inventory (Activity)

**Operations → MCP inventory** aggregates MCP servers from metadata-only Activity events:

- `downstreamServer` on tool-call enforcement events
- Client surface (`cursor`, `sdk`, `claude-code`, …)
- Platform labels from MCP live test and sidecar enforce

This is **v1 shadow MCP detection** — not a Konnect-class registry, but sufficient for pilot eval and SOC triage.

→ [MCP inventory](/operations/mcp-inventory) · [Runtime log](/operations/activity)

## 2. Cluster static discovery (nhim-audit)

`@blekline/nhim-audit` discovers **agent candidate workloads** via labels, env keys (`MCP_SERVER_URL`, `OPENAI_API_KEY`), and images. Upload JSON to **NHIM posture** for fleet rollup and agent candidate tables.

```bash
npx @blekline/nhim-audit audit --profile generic --plain --json -o nhim-audit.json
```

Rules NHIM-001..019 map bypass paths including wide HTTPS egress (NHIM-014), hostNetwork (NHIM-019), and Auto-Route gaps.

## Progressive response

| Phase | Action |
|-------|--------|
| **Audit** | Inventory shadow servers; no block |
| **Warn** | Mask / flag tool args; SIEM alert |
| **Block** | `@blekline/mcp-proxy` registry deny unknown servers + mandatory hop |

→ [Progressive enforce](/docs/enterprise/k8s-deployment#progressive-enforce) · [MCP proxy](/docs/mcp/proxy)

## Related

- [Reference architecture](/docs/enterprise/reference-architecture)
- [NHIM audit CLI](/docs/tools/nhim-audit)
- [Compliance evidence](/docs/enterprise/compliance-evidence)