New usage data from Runlayer - one of the leading MCP infrastructure providers - just gave the enterprise AI security community something it has been missing: a real picture of which MCP integrations enterprises are actually deploying at scale.
The top 10 MCPs by usage across their customer base, from fast-growing startups to enterprise companies, tell a story that goes well beyond adoption rankings. It tells you exactly where the enterprise MCP governance surface is, and how large it has become without most security teams noticing.
The Model Context Protocol is the connection layer that allows AI agents to interact with tools, data sources, and external systems. It has become the standard interface for how enterprise AI agents actually do their work, connecting agents to the applications, databases, and communication platforms they need to be useful.
Every MCP connection establishes a persistent trust relationship between an AI agent and the system it connects to. The agent authenticates to the MCP server once, establishing a session within which multiple tool calls can occur. What happens inside that session - which data is accessed, which actions are taken, which instructions the agent follows - is governed by the MCP server itself.
Most enterprise identity governance stacks have no visibility into this layer. Your identity provider sees the authentication event. It does not see what happens inside the MCP session. Your CASB sees the network traffic. It does not understand the MCP protocol well enough to interpret what the agent is doing within the session.
The result: every MCP connection in your environment is a governance surface that most security tools cannot see.
1. Slack
Slack is the clear frontrunner in enterprise MCP adoption - 2.4x higher usage than the next most popular integration. Every organization deploying AI agents in Slack is creating a persistent trust relationship between those agents and the communication layer of their entire organization.
The governance implications are significant. Slack contains some of the most sensitive unstructured data in any enterprise - strategic discussions, personnel conversations, financial decisions made in real time. An AI agent with MCP access to Slack can read, summarize, and act on that data continuously. The question that most governance programs cannot answer: is this agent accessing only the Slack channels its organizational intent authorizes, or has its scope drifted to channels it was never meant to see?
When an agent can read Slack messages and take actions based on their content, every message in its accessible channels is a potential injection vector. A carefully crafted Slack message can instruct an agent to take actions it was never authorized to take - using the same MCP connection that was legitimately provisioned.
2. Google Workspace
Google Workspace MCP gives agents access to Gmail, Google Drive, Google Docs, Google Calendar, and the full productivity stack. For enterprises that run on Google, this is comprehensive access to the organization's working memory - every document, every email, every scheduled meeting.
The governance surface here is not just data access. It is action capability. An agent with Google Workspace MCP can send emails on behalf of users, create and modify documents, schedule meetings, and share files. Each of these actions can have external-facing consequences - emails sent to customers, documents shared outside the organization, calendar invitations sent to third parties.
Governing this MCP requires knowing not just what data the agent can access, but what actions it is authorized to take and what the organizational intent boundaries are for each action type.
3. Snowflake
Snowflake MCP gives agents access to your data warehouse - the centralized repository where the most sensitive, structured business data in your organization lives. Revenue figures. Customer data. Financial records. Operational metrics.
The governance implication is straightforward: an agent with Snowflake MCP access can query any dataset the connection is authorized to reach. The question governance programs need to answer is whether the agent is querying data consistent with its declared purpose - or whether it is ranging across datasets that happen to be accessible but were never within the agent's intended operational scope.
Data access drift - an agent querying progressively broader datasets over time, is one of the hardest governance failures to detect with traditional tools. It does not trigger security alerts because the queries are authorized. It does not appear in DLP logs because the data is being processed through a legitimate tool call. The only way to catch it is continuous evaluation of the agent's data access patterns against its organizational intent baseline.
4. Datadog
Datadog MCP gives agents access to your observability infrastructure - logs, metrics, traces, alerts, and the full operational telemetry of your production environment.
"This is the MCP connection that makes GhostJacking possible. Security researchers demonstrated at DEF CON 34 that malicious instructions embedded in log files - which agents access through exactly this kind of observability MCP - can redirect an agent to take actions it was never authorized to take."
An agent with Datadog MCP access that reads attacker-controlled log content is an agent that can be silently steered. The MCP connection is legitimate. The authentication is valid. The governance failure is the absence of a layer that evaluates whether what the agent is doing in response to what it read is consistent with its organizational intent.
5. GitHub
GitHub MCP gives agents access to your code repositories - the source of truth for your organization's technical assets, intellectual property, and production systems.
The governance surface here extends beyond data access to code execution capability. An agent with GitHub MCP can read code, write code, open pull requests, and - in some configurations - trigger deployments. Each of these capabilities represents a distinct governance boundary that requires explicit organizational intent definition.
The GhostJacking research was specifically demonstrated against AI coding agents with GitHub access. The attack path - malicious instructions in one system, agent execution in another - is the governance pattern that organizational intent enforcement is designed to prevent.
6. Notion
Notion MCP gives agents access to your organization's knowledge base - the documentation, wikis, project plans, and institutional memory that teams build over time.
The governance implication is primarily around data sensitivity classification. Notion databases often contain a mix of publicly shareable content and sensitive internal documentation - personnel information, strategic plans, financial models - in a structure that does not always make the sensitivity boundary obvious to an agent operating autonomously.
An agent with Notion MCP access needs organizational intent that specifies not just which Notion databases it can access, but what types of content within those databases are within its operational scope.
7. Granola
Granola provides AI-powered meeting notes and context. Granola MCP gives agents access to everything your organization has discussed in meetings- decisions made, action items assigned, context established.
The governance implication is significant and under-appreciated. Meeting transcripts contain some of the most sensitive contextual information in any organization - personnel discussions, strategic decisions, financial commitments, customer intelligence. An agent with access to this context can pull information from meetings it was never intended to attend.
The Runlayer data predicts Granola will gain significant ground as enterprises recognize the value of giving agents meeting context. The governance infrastructure needs to keep pace with that adoption - specifying organizational intent boundaries for which meetings and which types of content are within each agent's authorized scope.
8 - 10. The Long Tail
The Runlayer data notes an extreme long tail to the MCP usage list — agents reflecting the individual tools and usage patterns of each customer. This long tail represents the most significant governance challenge, because it is precisely where shadow MCP connections accumulate.
Every tool in the long tail is a MCP connection that was configured by a developer, an IT team member, or an employee building an agent. Each connection is a persistent trust relationship between an AI agent and a system that contains enterprise data. Most of these connections were never reviewed by security. Many were never documented.
The long tail is where the governance surface is largest, and the visibility is lowest.
Looking at the full top 10 - Slack, Google Workspace, Snowflake, Datadog, GitHub, Notion, Granola, and the long tail - a consistent governance pattern emerges.
Every MCP connection in this list shares three properties that create governance risk when left unmanaged:
Persistent trust. Each connection establishes an ongoing relationship between an agent and a system. The authentication happens once. What happens inside the session - every tool call, every data access, every action - continues without re-evaluation unless a governance layer specifically evaluates it.
Broad data access. Each of these systems contains sensitive enterprise data that was never intended to be universally accessible to every agent that might connect to it. Slack messages were not written for agent consumption. Snowflake datasets were not designed to be queried by any agent with the right MCP credentials.
Action capability. Each of these MCPs enables agents to do things, not just read things. Send emails. Commit code. Query data. Modify documents. These actions have consequences that extend beyond the agent's session and can affect other humans, other systems, and external parties.
The combination of persistent trust, broad data access, and action capability is what security researchers have called the "lethal trifecta" - the three conditions that, present simultaneously, make an agent governable in theory and ungoverned in practice.
Every MCP in the Runlayer top 10 satisfies all three conditions.
The governance infrastructure that closes the MCP gap operates at the protocol level - not adjacent to it. Here is what that requires in practice.
Per-connection organizational intent. Every MCP connection needs a structured definition of what the agent is authorized to do within that connection- not just which systems it can reach, but which data it can access, which actions it can take, and what the boundaries of its operational scope are within that specific integration.
This is not the same as the permissions the MCP server grants. Permissions define the technical capability. Organizational intent defines the authorized purpose. An agent with Slack MCP access that is authorized to summarize messages in the #product-updates channel is not authorized to read messages in #executive-strategy, even if both channels are technically accessible through the same MCP connection.
Runtime evaluation of tool calls. Every tool call the agent makes through an MCP connection is evaluated in real time against the organizational intent baseline, before the call completes. Not logged and reviewed after the fact. Evaluated at the moment of execution.
This is the control that catches GhostJacking. An agent that reads a malicious instruction in a Datadog log and is about to modify DNS settings - a tool call that is outside the organizational intent of an incident-investigation agent - is stopped before the modification executes, not discovered in the next audit cycle.
Cross-connection behavioral monitoring. Enterprise AI agents do not use a single MCP connection in isolation. They chain connections - reading from Datadog, writing to GitHub, notifying in Slack, updating in Notion. The governance layer needs to evaluate the behavioral pattern across connections, not just within each one individually.
An agent that is querying Snowflake data and then posting summaries to an external Slack channel it has never accessed before is exhibiting a behavioral pattern that warrants evaluation - even if each tool call is within the authorized scope of its respective MCP connection.
Discovery of the long tail. The most significant governance gap in most enterprise MCP deployments is not the top 10 - it is the connections in the long tail that were never formally registered, never reviewed by security, and are currently operating with no governance layer between the agent and the systems they connect to.
Real MCP governance finds every connection in the environment - not just the ones that were formally registered - through integration with the security infrastructure already in place.
What is MCP security? MCP security refers to the governance and protection of Model Context Protocol connections between AI agents and enterprise systems. Because MCP connections establish persistent trust relationships that allow agents to access data and take actions within enterprise tools, they create a governance surface that traditional identity and security tools are not designed to observe or control. MCP security encompasses discovery of all MCP connections in an environment, organizational intent definition for each connection, runtime evaluation of agent tool calls against that intent, and behavioral monitoring across connections.
What are the security risks of MCP integrations? The primary security risks of MCP integrations are persistent unauthenticated access to enterprise systems, the inability to distinguish legitimate agent activity from attacker-redirected activity within an authorized session, data access drift where agents range beyond their intended operational scope, and prompt injection attacks that embed malicious instructions in content the agent reads through MCP connections. The combination of persistent trust, broad data access, and action capability - present in most enterprise MCP integrations - creates conditions where governance failures can have significant operational and security consequences.
How do you govern Slack MCP connections for AI agents? Governing Slack MCP connections requires defining organizational intent at the channel and content type level - specifying which channels an agent is authorized to access and what types of content it is authorized to process - and continuously evaluating the agent's actual Slack activity against that intent baseline at runtime. Effective Slack MCP governance also requires monitoring for prompt injection attempts embedded in Slack messages, which can redirect an agent to take unauthorized actions using the legitimate access the MCP connection provides.
What is the difference between MCP permissions and organizational intent? MCP permissions define the technical capability of an MCP connection - which systems an agent can reach and which API calls it can make. Organizational intent defines the authorized purpose of those capabilities - what the agent was actually built to do within the systems it can access. An agent may have technical permission to query any dataset in Snowflake while its organizational intent limits it to specific financial datasets relevant to its reconciliation function. Governance that enforces only permissions leaves the gap between technical capability and authorized purpose ungoverned - which is where most agent drift and misuse occurs.
How does MCP governance relate to ARISE? ARISE - Agentic Runtime Identity Security Enforcement - is the emerging analyst category for platforms that govern enterprise AI agents at the identity and runtime behavioral layer. MCP governance is a core component of the ARISE capability set, specifically within the runtime behavioral governance and cross-chain accountability dimensions. A complete ARISE platform provides organizational intent capture per MCP connection, runtime evaluation of tool calls against that intent, and behavioral monitoring across MCP connections - closing the governance surface that MCP integrations create.
aizome is an Enterprise AI Agent Identity Fabric Platform and a founding player in the ARISE - Agentic Runtime Identity Security Enforcement - category. aizome governs every MCP connection in your enterprise environment - discovering every agent, enforcing organizational intent at the tool call level, and continuously evaluating behavioral patterns across connections.
Come see it in action at aizome.ai
