Statiostatio
PricingBlogStart free
Getting Started
What is MCP?What is Statio?Quickstart
Core Concepts
GatewayCredential VaultingAccess PoliciesAudit Trails
Tools
mcp-gen CLImcphub CLIShadow AI Detection
Security
Threat ScanningSecret DetectionArchitecture
Shadow AI DetectionDiscover unauthorized MCP servers across your organization.

Shadow AI is the MCP equivalent of shadow IT — developers installing and configuring MCP servers on their machines without security review or organizational approval. Every unvetted MCP server is a potential data exfiltration path, and most organizations have no visibility into what's configured.

The problem

AI coding tools like Cursor, Claude Code, VS Code Copilot, and Claude Desktop all support MCP. Each stores its configuration in a local file:

# Claude Desktop ~/Library/Application Support/Claude/claude_desktop_config.json # Cursor ~/.cursor/mcp.json # VS Code ~/.vscode/settings.json (mcp section) # Claude Code ~/.claude/settings.json

Any developer can add an MCP server to these configs — from a GitHub repo, an npm package, or a random URL. There's no approval flow, no security scan, no audit trail. The organization has zero visibility into what tools their AI agents can access.

ImportantA single malicious or misconfigured MCP server can exfiltrate code, credentials, or proprietary data through tool call responses. The agent doesn't know the difference — it just calls the tool.
How mcphub detects shadow MCP

The mcphub CLI — Statio's client-side tool — scans for MCP configurations across all known AI client config locations. It reports what's configured, what's approved, and what's unauthorized.

$ mcphub scan Scanning MCP configurations... Claude Desktop (claude_desktop_config.json) ✓ stripe-mcp → statio (approved) ✓ github-mcp → statio (approved) ✗ random-npm-mcp → npx (unauthorized) ✗ local-file-server → stdio (unauthorized) Cursor (.cursor/mcp.json) ✓ statio-gateway → https://gateway.statio.dev (approved) ✗ sketch-to-code → npx (unauthorized) Summary: 3 approved, 3 unauthorized Run 'mcphub report' to submit to your organization.
How it works

1. Developer installs mcphub and authenticates with their Statio organization.

2. mcphub scan reads all known MCP config file locations on the machine.

3. Each discovered server is checked against the organization's approved server registry.

4. Unauthorized servers are flagged with details: name, transport type, command, and source.

5. mcphub report optionally submits the scan results to the org admin dashboard.

Developer-first approach

Unlike MDM-based shadow AI detection (which requires IT to push agents onto developer machines), mcphub is developer-installed. The developer opts in by authenticating with their org. This means:

—

No MDM infrastructure required (no Intune, Jamf, or Kandji)

—

Works on any OS — macOS, Linux, Windows

—

Developers control when scans run (not IT pushing scans remotely)

—

Zero friction — mcphub is already installed for MCP config generation

—

Org admins get aggregate visibility without device-level surveillance

Organization dashboard

When developers submit scan reports, the org admin dashboard aggregates the data:

—

Total MCP servers across all developer machines

—

Approved vs unauthorized breakdown

—

Most common unauthorized servers (trending threats)

—

Per-developer compliance status

—

Alerts when new unauthorized servers appear

Learn more
mcphub CLI reference →Threat scanning →Enterprise use case →
Statiostatio
Security-first MCP governance for AI agents. Credential vaulting, access policies, audit trails.Open source on GitHub
ProductFeaturesPricingGetting StartedSecurityChangelogmcp-gen
CompanyAboutBlogGitHubContactSID Technologies
LegalPrivacy PolicyTerms of Service
© 2026 Statio. A product of SID Technologies.