Skip to main content

MCP Inventory

An agent reaches the outside world through MCP servers — the tool servers it calls to raise a ticket, query a directory, or read a wiki. Each one holds a credential, and that credential is what the agent actually acts with. MCP Inventory is the single list of every MCP server your tenant can reach, which credential is bound to each, and what that combination is doing wrong.

Until now that estate lived in two places that never reported to a third. Beak AI Hub holds the shared catalogue of first-party servers and one connection per tenant, per user. Beak AI Studio holds whatever someone registered directly — usually the larger half, and usually the half nobody was looking at. MCP Inventory reads both and stores one record.

Note: This release ships MCP Inventory as an API only — there is no screen for it yet, which is why this page carries no screenshot. The console view is a later release, and screenshots will be added with it.

What it reads, and what it never reads​

The inventory stores metadata and fingerprints only. No credential, no token, and no configuration value ever reaches Beak AI Security. Hub and Studio each reduce a credential to its authentication type and a one-way digest of the encrypted value before it leaves them.

  • Credential fingerprint — a SHA-256 of the stored ciphertext. It changes when the credential changes, so you can see that a secret was rotated, or that a connection was re-pointed at a different account, without anyone being able to read the secret itself.
  • Tool fingerprint — a digest of the server's tool names and their descriptions. The description is what steers an agent, so a server that quietly rewrites what a tool claims to do shows up here as drift.
  • Inline secret paths — where a credential was pasted directly into a server's configuration, reported as a path (config.headers.Authorization), never as the value.

Running a sync​

MCP Inventory is refreshed by an operator action, not a background job. Beak AI Security reads Hub and Studio as you — forwarding your own credentials — so it can never see more of the estate than you already could, and no standing cross-service secret has to exist for it to work.

PermissionWhat it allows
mcp_servers:readRead the inventory and its findings. Included in the analyst and viewer roles.
mcp_servers:syncRun a sync. Included in the analyst role.

Because the sync reads as you, the Beak AI Hub half additionally requires tenant-administrator rights. Hub's inventory spans every user's connections, not just your own, so it is an administrator's view there — a non-administrator's sync still inventories Beak AI Studio in full and records Hub as a failed source with the refusal as its reason.

Note: If one source cannot be read, the other half is still inventoried. Nothing is deleted, the failure is recorded, and the unread source is reported as a finding.

Coverage is part of the answer​

Every page shows which sources were read and when. This is not a footnote — a count drawn from a source that was never read is not a small inaccuracy, it is the opposite of the truth stated confidently. "This tenant has no Hub connections" and "we never asked Hub" are the same zero.

  • Ok — the source was read successfully, with the time and the number of servers seen.
  • Failed — the last attempt did not succeed, with the reason. Earlier results are retained.
  • Never read — this source has not been inventoried at all. No finding on the page speaks for it.

If a source shows Never read or Failed, ask your administrator to confirm that Hub and Studio are reachable from Beak AI Security in this environment.

Findings​

FindingSeverityWhat it means
A source has never been inventoriedHighPart of your estate is invisible. Every count on the page excludes it.
A source read failedHighThe inventory is whatever survived an earlier sync.
Connections reachable by agents but authorized as a humanHighBeak AI Hub authorizes an MCP tool call only when the connection is bound to an agent's identity. These are bound to a tenant or a person, so an agent calling through them is checked against nothing — the call is made with a human's credential and no per-agent decision is recorded.
A server registered on a temporary developer tunnelHighThe address stops resolving when the developer closes their terminal, and the same name can then be issued to somebody else — at which point your agent's tool calls, and the credential attached to them, go to a stranger.
A server addressed in cleartext outside the clusterHighThe credential and every tool argument cross the network unencrypted. Addresses inside the cluster are excluded, where traffic is already protected.
A credential pasted into a server's configurationCriticalStored unencrypted, returned by every read of that record, and not rotatable through the credential store.
A credential no agent usesMediumAccess is granted and a secret is stored, but nothing calls through it — so nothing would notice if something did.
A server whose tools changedMediumThe tool list or its descriptions changed in the last 30 days. Confirm the change was expected.
A server whose address names no hostMediumThe registration is live and selectable by an agent, but resolves to nothing.
A configuration that could not be scannedLowThe stored configuration would not parse, so Beak cannot say whether it holds a credential. Reported as unknown rather than clean.
The inventory has not been refreshedLowOlder than 48 hours. A server registered since then is not shown.

Best Practices​

  • Run a sync before any review of agent access. The inventory is a snapshot, and its age is shown for exactly that reason.
  • Treat a Never read source as the first thing to fix. Nothing else on the page is complete while it says that.
  • Bind an agent's MCP connection to that agent's identity. It is what makes a per-agent authorization decision possible at all; a tenant- or user-scoped connection cannot be governed per agent.
  • Investigate a changed credential fingerprint you did not expect. A planned rotation and a connection re-pointed at somebody else's account look identical from here.
  • Remove registrations pointing at temporary tunnels before they reach a shared environment.