What happened
On Sept 30, 2026, Snyk made 'Govern Agent Behavior' generally available in Evo Agentic Development Security (ADS), starting with MCP Governance: teams inventory MCP servers, set approved allowlists, and log or block unauthorized MCP usage live at the endpoint across Claude Code, Cursor, Codex and GitHub Copilot via lightweight hooks (no proxy). Snyk scan data from ~10K dev environments found 4,524 unique MCP servers in active use, with 1 in 12 developers having a high/critical MCP-related finding.
Why it matters
The first major AppSec vendor shipping GA runtime policy enforcement for agent tool usage closes the gap where MCP servers are added dynamically with no review — a newly dominant supply-chain vector. Broad blast radius given Snyk's developer base; native in the agent workflow rather than bolted on.
Applicability
Security/platform teams standardizing AI coding agents (Claude Code, Cursor, Codex, Copilot) should adopt MCP allowlisting/blocking now, especially where 1:12 MCP-server risk rates apply; evaluate alongside other endpoint hook-based agent controls.