What is MCP governance?
+
The part of AI governance that covers MCP servers and tools. It decides which tools exist, who and which AI assistants can call them, how servers are published and retired, and keeps a record of every call.
What are shadow AI and shadow MCP?
+
Shadow AI is any AI tool, assistant or agent people use for work without IT knowing. Shadow MCP is the riskiest kind, MCP servers people set up and run themselves, usually on a laptop and with their own credentials. Each one is a way into a company system that nobody reviewed, and most keep no record of what they were asked to do.
Do we have to stop teams adopting AI tools or building their own MCP tools?
+
No. Blocking a tool people find useful moves it somewhere you can't see it. Give builders a managed path instead, where IT approves what goes live. J.W. Pepper took this route and kept its employees in Microsoft Copilot, the assistant they already used, with tools opted in and restricted to reads where that made sense.
Which AI assistants work with Agent Gateway for MCP?
+
Agent Gateway for MCP governs MCP whatever the client. Copilot Studio, Claude, OpenAI and agents built on your own framework all get the same access rules and the same log.
Does access follow Okta groups?
+
Access to each server is set with role-based access control in Tray.ai, and the access control guide shows how to drive it from your identity provider's groups in Okta or Azure Active Directory. Someone who leaves the group loses access to the server on the next sync, without a separate ticket.
Which agent actions need a person's approval?
+
Not all of them. Approval for everything trains people to approve without reading. Agents act on their own for actions that are small and easy to undo, and ask first for anything that reaches a customer, moves money, changes many records or can't be undone.
How do we see what AI is costing us?
+
Record usage and spend on every model call, by agent and by team, in a place finance and IT both read. Alert when spend speeds up, so a runaway loop shows up the same day rather than on the invoice.
Why govern AI and MCP now?
+
Gartner predicts that by 2027, 40% of enterprise MCP deployments will be affected by security incidents, from prompt injection, data access and agent misconfiguration. Each unmanaged server adds one more credential and one more gap in the log.
Is the platform itself audited?
+
Yes. Tray.ai is SOC 1 and SOC 2 Type 2 audited every year, and covers HIPAA, GDPR and CCPA requirements. The reports are available through the trust center.
How is AI and MCP governance different from AI agent deployment?
+
AI agent deployment covers building and running agents, from grounding them in company knowledge to watching every run. AI and MCP governance covers governing every AI tool and agent the company uses, including the ones it didn't build, from finding them to reviewing who still has access. Most teams need both, and on Tray.ai they share the same access rules and logs.
.DkNUKaKx_ZLAT4m.webp?dpl=dpl_27YiVb46fG1g2qXC7FPsjnva6Vrw){kind=small}
.DkNUKaKx.png)
.DkNUKaKx_mwaey.webp?dpl=dpl_27YiVb46fG1g2qXC7FPsjnva6Vrw)
