# What MCP is and why it needs governing

Model Context Protocol is how an AI assistant gets hands. Without it, an assistant can
only produce text. With it, it can read your files, query your database, open issues,
fetch web pages, send messages.

That is also the entire security problem in one sentence: **MCP is where a language model
stops talking and starts acting.**

## Two kinds of server, two ways to govern

**Local servers** run as processes on the developer's own machine, started by the AI tool
itself. The Gateway never sees them — they never touch the network Sentilai is on. These
are governed by the Sentilai shim, installed by the Endpoint Suite.

**Remote servers** are reached over HTTP. These can be governed centrally by pointing the
tool at a Sentilai **routed endpoint** instead of at the server directly.

There is also a third, weaker signal: the AI tools declare the MCP tools available to them
inside their chat requests, which the Gateway can see even without the shim. That is enough
for inventory and for coarse policy, but not for per-tool decisions.

## What can go wrong

- A server nobody reviewed, installed by one developer, with access to everything.
- A server whose tool descriptions change after you approved it — the "rug pull".
- A perfectly good set of servers that together give an agent private data, untrusted
  content and a way out at the same time.

Sentilai addresses all three: an inventory with an approval gate, schema fingerprinting to
notice changes, and the lethal-trifecta detector for the combination.

## Where to start

Run with **MCP default action: Report** for a week. Then look at **MCP Inventory** and be
surprised. Almost every organization finds at least one server they did not know about.