Build a Non-Human Identity Governance MCP Server for Agent Sprawl & SSRF Control in 2026

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

Introduction

On July 28, 2026, Cyera signed a letter of intent to acquire Oasis Security for roughly $1 billion — the biggest deal yet in the scramble to secure AI agent identities. The premise is blunt: AI agents do not log in like people. A service account, an API key, a workload token, an autonomous agent — each is a non-human identity (NHI) that can authenticate, hold secrets, and act. The statistics behind that price tag are now common knowledge in security teams. Non-human identities already outnumber human employees 45 to 1 in the average enterprise. In Fortune 500 companies NHI counts grew nearly 500% in six months. Meanwhile 92% of organizations report their legacy IAM tools cannot manage AI agent identity risk, and only 12% have automated lifecycle management.

The MCP layer makes this more urgent, not less. An analysis of 7,973 live MCP servers found 40% had zero authentication enabled, and every OAuth-enabled server tested carried at least one vulnerability — 96.6% affected by dynamic client-registration flaws that let unauthorized clients impersonate legitimate agents. GitGuardian found roughly 24,000 secrets sitting in MCP configuration files on public GitHub, and 28.65 million new hardcoded secrets were committed to public GitHub in 2025, up 34% year over year.

This guide builds the missing control plane as — fittingly — an MCP server: an NHI governance server that inventories every non-human identity, graphs what it can reach, issues short-lived scoped tokens, and revokes access instantly without a human in the loop. It operationalizes exactly what the Cyera-Oasis deal says the market now demands. For the system-side patterns around containment and access, see our AI workflows library; the server you build here guards the tool layer cataloged in the MCP directory.

Why Agents Are Not Service Accounts

The mental model "an agent is basically a service account" is wrong in a way that matters. A service account lives in one system, holds one credential, does one job. An agent chains systems — it authenticates to a git host, a cloud API, a database, and a secrets store in a single autonomous run. Compromise of that identity is not contained to one service, and attackers exploit agent tokens 85× faster than most teams can rotate them. Governance therefore means: per-agent identity, least privilege, short-lived credentials, full logging, and revocation without waiting on a human.

graph TD
  A[Agent Piper] --> B[NHI Governance MCP Server]
  B --> C[Identity Inventory]
  B --> D[Permission Graph]
  B --> E[Token Issuer]
  B --> F[Revocation / Scoping]
  C --> G[Service Accounts, API Keys, Agent MCP Configs]
  D --> H[AWS / GCP / SaaS / Secrets]
  E --> I[Short-lived Scoped Tokens]
  F --> J[Revoke on Anomaly]

Part 1 — Server Implementation

.env

REGISTRY_DB=sqlite:///./nhis.db
SECRETS_BACKEND=aws-secretsmanager
ISSUER_URL=https://idp.example.com
FEDERATION_AUDIENCE=nhi-governance
ANOMALY_WINDOW_MIN=15

schemas.py

from pydantic import BaseModel
from typing import Dict, List, Optional
from enum import Enum

class IdentityType(str, Enum):
    service_account = "service_account"
    api_key = "api_key"
    workload = "workload"
    agent = "agent"
    mcp_client = "mcp_client"

class NHIRecord(BaseModel):
    id: str
    type: IdentityType
    owner_team: str
    permissions: Dict[str, List[str]]  # {service: [scopes]}
    created_at: str
    last_used: Optional[str]
    rotation_days: int

class TokenIssue(BaseModel):
    identity_id: str
    service: str
    scopes: List[str]
    ttl_seconds: int = 900

class RevocationRequest(BaseModel):
    identity_id: str
    reason: str
    force: bool = False

tools.py

import hashlib

def fingerprint_config_raw(raw: str) -> str:
    """Hash MCP config content to detect drift and leaked secrets."""
    return hashlib.sha256(raw.encode()).hexdigest()

def is_over_permissioned(record: NHIRecord) -> List[str]:
    """Flag identities holding admin scopes graphs rarely need."""
    flagged = []
    for service, scopes in record.permissions.items():
        if "admin:*" in scopes and record.type in ("agent", "mcp_client"):
            flagged.append(service)
    return flagged

server.py

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("nhi-governance")

@mcp.tool()
def inventory() -> list[NHIRecord]:
    """Return every non-human identity and its last-used-at."""
    return registry.list_all()

@mcp.tool()
def graph_access(identity_id: str) -> dict:
    """Return the permission graph: services and scopes an identity touches."""
    return registry.permission_graph(identity_id)

@mcp.tool()
def issue_token(identity_id: str, service: str, scopes: list[str]) -> TokenIssue:
    """Issue a short-lived, scoped token. Refuses admin scopes for agents."""
    if "admin:*" in scopes:
        raise PermissionError("agents cannot be issued admin-scoped tokens")
    return token_service.issue(identity_id, service, scopes, ttl=900)

@mcp.tool()
def revoke(identity_id: str, reason: str) -> dict:
    """Revoke immediately across all secrets backends; logs the reason."""
    return registry.revoke_all(identity_id, reason)

inputSchema (extract)

{
  "name": "issue_token",
  "inputSchema": {
    "type": "object",
    "properties": {
      "identity_id": { "type": "string" },
      "service": { "type": "string" },
      "scopes": { "type": "array", "items": { "type": "string" } }
    },
    "required": ["identity_id", "service", "scopes"]
  }
}

Part 2 — Client Configuration

mcpServers Config

{
  "mcpServers": {
    "nhi-governance": {
      "command": "python3",
      "args": ["server.py"],
      "env": { "REGISTRY_DB": "sqlite:///./nhis.db", "ISSUER_URL": "https://idp.example.com" }
    }
  }
}

Agents connect to the governance server before attempting any cross-service call. issue_token then returns a 15-minute scoped token, which is exactly the short-lived posture researchers and regulators now demand for machine actors. Because the governance server itself centralizes secrets handling, agent code never sees long-lived keys.

OAuth 2.0 for the Registry

The registry is admin surface. Expose it with OAuth 2.0 client-credentials + PKCE for interactive:

1. Register the governance server as a confidential client in your IdP.
2. Require scope=nhi:read nhi:write per tool; agents get nhi:read only.
3. Short TTLs everywhere: admin tokens ≤ 15 min, agent tokens per-task.
4. Send every registration/revocation event to the SIEM under a fixed schema.

SSRF & Sprawl Mitigations

• Allowlist tool endpoints: the governance server resolves only the services in the registry; unknown hosts are refused instrument-level, blocking the SSRF class of MCP attacks at the boundary.
• Dynamic client registration off for public endpoints, or pin client_id allowlists so unauthorized clients cannot impersonate agents.
• Rate-limit registrations to stop sprawl from cloaking itself; alert on >50 new identities/hour.
• Rotation enforced: any identity older than its rotation_days is flagged and refused token issuance.

Production Checklist

1. Inventory all NHIs first — including MCP config files on GitHub (then revoke leaked secrets).
2. Per-agent identity, never shared service accounts; agents never get admin scope.
3. Issue short-lived, task-scoped tokens and log every issuance and revocation.
4. Turn off dynamic client registration on public MCP auth; pin allowlists.
5. Treat every credential as compromised until proven otherwise; rotate continuously.

Lifecycle automation without a human in the loop

The point of the governance server is that revocation and rotation do not wait for a ticket. When the anomaly detector flags an identity issuing from an unexpected region, or a CI job discovers a token leaked in a commit, revoke() fires immediately across every secrets backend and writes the reason to the audit log. That automated kill path is what separates the 12% of organizations that automate lifecycle from the 88% that track machine identities in spreadsheets. Build it as an async event: the governance server subscribes to the SIEM and secrets scan, and triggers revocation the moment a condition trips. The metric to fight for is time-to-revoke: from detection to all-backend revocation, measured in seconds. If it is under 30 seconds your agent fleet is defensible; if it is measured in days you are back to spreadsheets with a prettier UI.

The SSRF angle in the MCP tool layer

SSRF in MCP servers is not a database problem, it is a trust-your-config problem. Public servers that accept arbitrary endpoints let an agent — or an attacker driving an agent — reach internal IP ranges and metadata services. The governance layer cuts this by resolving only registered endpoints, enforcing allowlists at the tool registry, and adding rate limits per registration. Combined with the authentication fixes (disabling dynamic client registration on public auth, pinning client-id allowlists), the NHI governance server turns the common MCP exposure class into an enforce-first posture rather than a scanning exercise. The same rule set — allowlist, sign, scope, revoke — is the backbone of the enterprise patterns in our AI workflows library, and the wider server ecosystem is tracked in the MCP directory.

A minimum-viable rollout in five steps

Stand up the registry DB, import your top NHIs from the cloud and SaaS inventory (admins export these), attach the secrets-scan feed, and turn on issue_token and revoke for one critical agent. Measure time-to-revoke immediately — that number is your security headline. Then widen identity coverage weekly and wire the anomaly detector to the SIEM. Most organizations already have the data; the work is consolidation. The discipline rhymes with the access-control patterns in our AI workflows library: inventory before governance, automation before scale, and measurable revocation before claiming you secured the agent workforce.

Frequently Asked Questions

Q: What is a non-human identity (NHI) and why does it matter?

A: An NHI is any credential that authenticates without a person behind it — service accounts, API keys, workload tokens, or autonomous agents. NHIs now outnumber humans ~45:1 in the enterprise, making them the fastest-growing identity type and the target of the Cyera-Oasis $1B deal.

Q: Why are MCP servers a security gap in 2026?

A: Research across 7,973 live servers found 40% ran with no authentication and 96.6% of OAuth-enabled servers had dynamic client-registration flaws. Secrets also leak via MCP config files in public repos. The protocol standardized tool access before it standardized tool security.

Q: How do you secure an agent's identity?

A: Give every agent its own identity, scope it to least privilege, issue short-lived per-task tokens, centralize secrets, log all access, and be able to revoke instantly without a human in the loop.

Q: What does "agents get nowhere near admin scope" mean operationally?

A: The governance server refuses to issue admin-scoped tokens to agent or MCP-client identities at the tool layer, and flags any identity whose permission graph already holds admin scope for remediation — a hard rule, not a policy suggestion.