Contact Open demo
Solutions / By agent

Every MCP server is a doorway with credentials behind it

An agent only needs to ask. The server it asks holds the tokens, grants and keys. nerl0 lists every MCP server and shows what its credentials open.

Open the demoHow connectors read
AGENT ASKSSERVER HOLDSAND REACHES Claude Codecalls a tool aws-mcpAPI keystoredOAuth grantstoredAccess tokenstored

What sits behind a tool call

To the agent, an MCP server is a list of tools. Behind that list, the server keeps the credentials it needs to act for you, and whoever can use the server can use them.

  • TokensPersonal and service tokens for code, chat and ticket systems.
  • OAuth grantsAccess a person approved once and the server keeps using.
  • API keysKeys for cloud, database and AI providers, often in the server environment.
aws-mcp
Local server · stdio · started by 2 agents
Assign ownerNarrow credential⋮
Credentials it holds
⚷
AWS access keyStored in the server environment · assume role allowed
Broad
◍
OAuth grant · SlackScope: read channel history and post messages
Scoped
⌗
API token · JiraScope: read and write on all projects
Broad
Used by
ops-automation-agentClaude Code

Every server, who uses it and what it reaches

One list instead of a search through config files. Servers without an owner stand out, and each row opens the path behind it.

See Connectors

MCP servers

Every server your agents connect to, the credentials it holds and what those credentials reach.
⌕ Search servers⚲ FilterOwner ⌄
ServerUsed byCredentialReachesOwner
github-mcpRemote · OAuth
Claude Code, Cursor
GitHub token repo, workflow
1 crown jewel
MCMaya Chen
postgres-mcpLocal · stdio
Cursor
Database password read, write
Production database
No owner
slack-mcpRemote · bot token
Claude Code
Bot token channels:history
Internal chat
DPDev Patel
aws-mcpLocal · stdio
ops-automation-agent
IAM access key assume role
prod/payments/stripe-key
No owner
jira-mcpRemote · API token
Cursor
API token read, write
Tickets
MCMaya Chen
notion-mcpRemote · OAuth
Claude Code
OAuth grant workspace
Internal wiki
OHOmar Haddad

Where it goes wrong

Three patterns repeat. None of them needs an attacker to be clever.

01Broad scopeA token created for one task keeps every permission it was given, long after the task ended.
02Shared by manyOne server serves several agents, so each of them inherits what any of them was allowed.
03Hidden instructionsTool input from a ticket, page or message can carry instructions the agent follows with the server's credentials.

Public cases are collected in the Agent Incident Tracker.

NewCritical
ops-automation-agent reaches prod/payments/stripe-key through aws-mcp, a server nobody owns
1
Agentops-automation-agent
2
MCP serveraws-mcp
3
CredentialIAM access key
4
Rolepartner-integration-role
5
Crown jewelprod/payments/stripe-key
Recommended breakpoint
IAM access key→partner-integration-role
RemediateAssignCreate a ticket

Follow one agent to the data

nerl0 turns a server into a path: agent, server, credential, role and the crown jewel at the end. The issue names the one hand-over to cut.

  • TraceFrom the agent to the data it can read or change.
  • RankPaths that end at crown-jewel data come first.
  • CutOne breakpoint, then the next scan shows whether it held.

Keep it, narrow it or remove it

Each server ends in one of three decisions, and the next scan checks it.

Keep

The server is owned and needs what it holds.

Give it a named owner and a reason. It stays on the list and is measured again with every scan.

Owner and purpose recorded
Narrow

The credential reaches more than the job needs.

Swap the broad key for a scoped one, or split a shared server into one per agent.

Reach drops on the next scan
Remove

Nobody owns it and nothing uses it.

Delete the server and revoke what it stored. The path to the data disappears with it.

Path no longer found

Questions to ask about your servers

The same questions nerl0 tracks, ready to activate in your workspace.

Open the Question Library
01Which MCP servers are connected to our agents?InventoryList02Which agents has nobody claimed an owner for?InventoryList03Which keys have never been rotated?IdentitiesList04Which agents can write to production?ExposureList05Which single grant would break the most paths if we revoked it?PathsPath

More solutions

Other ways into the same map of authority.

Browse the Academy

See what your MCP servers open.

Open the demoTalk to us