MCP governance shipped in three unrelated categories in one week, and the chokepoint is now obvious

GitHub added allowedMcpServers and deniedMcpServers keys to enterprise Copilot managed settings on August 6, configured to fail closed on malformed config, then followed on August 7 with a usage API exposing totals_by_3rd_party_agent for per-agent spend attribution (digitalapplied's writeup). Nutanix shipped an open-source MCP server on August 10 built directly on the Prism v4 API Gateway, so connected agents inherit existing NCP RBAC rather than needing a parallel permission model. And 15+ security vendors launched agent-infrastructure products at Black Hat USA inside 48 hours.

Three categories, no coordination, same architectural move: the MCP server becomes the metering and policy chokepoint.

The context that makes this urgent lands at MCP Dev Summit Seoul, which opens August 13. A scan found more than 21,000 internet-facing MCP server instances. Of 414 dynamically audited production servers, 91.8% run without OAuth at all. 687 tool instances expose shell execution with no access controls. Forkast's broader tally puts the ecosystem at 40+ disclosed CVEs and ~15,930 active public servers, with a Zero Day Initiative scan of 19,000 servers extrapolating 600–1,650 as exploitable. Of the vulnerable implementations, 26% carried SQL injection and 22.5% RCE.

The correlation buried in that data is the one I can't stop thinking about: 42% of vulnerable repos correlated with AI-generated code. We are using AI to generate the servers that give AI access to our systems, and the generation is producing the vulnerabilities and the exposure in the same motion.

The unresolved architectural fight going into Seoul is over the STDIO transport. Anthropic maintains that its unsanitized command execution is by design and a secure default, pushing sanitization onto downstream developers. Security researchers disagree, loudly. I don't think there's a clean answer here. STDIO's whole value is that it's a dumb pipe you can wrap around any binary in ten minutes, and the moment you sanitize it centrally you've broken the ten-minute property that made MCP spread.

Nutanix's choice is the one I'd copy. Building the MCP server on top of an existing API gateway means the permission model is the one your ops team already audits, already reviews, already knows how to revoke. Every bolt-on permission layer is a second source of truth that will drift from the first.

Concrete action: audit what MCP connections your team has open into enterprise tenants this week, before allowlists become the default posture and someone else does it for you. GitHub's fail-closed default tells you which direction this is going. If your MCP server doesn't have OAuth, you're in the 91.8%, and the scan that finds you has already been written.