Snyk makes MCP governance generally available in Evo ADS

Snyk said on 30 September 2026 that Evo ADS Govern Agent Behavior is now generally available, with the first capability in the release covering governance of MCP servers. According to the company, the feature lets organisations discover, approve, monitor, log and block MCP server usage across what it describes as leading AI coding agents.

MCP, the Model Context Protocol, is a standard way for AI agents to connect to outside tools, data sources and services. In a coding context that typically means an assistant reaching beyond the editor to a repository, a ticketing system, a database or a third-party service. That reach is what makes the protocol useful, and it is also what creates a control problem: a developer can add a server to their agent without anyone else in the organisation knowing it exists.

Snyk's framing of the release is that this usage needs to be brought under control. The five verbs the company uses — discover, approve, monitor, log, block — map onto a familiar governance pattern. Discovery tells a security team which servers are in use. Approval creates an allowed set. Monitoring and logging produce a record of what agents actually did. Blocking stops servers that have not been cleared. Snyk has not, in the announcement, published detail on which agents are supported or how enforcement is applied, and those specifics matter to anyone evaluating the product.

The launch sits alongside a broader argument the company is making about what it calls Agentic AppSec. In a companion post published the same day, Snyk describes this as using AI agents that are grounded, bounded and independently verified to run the application security loop. Grounded means the agent works from real evidence rather than generating plausible-sounding output. Bounded means its permissions and scope are constrained. Independently verified means something other than the agent itself checks the result. The company presents these three properties as the conditions under which agents can be trusted with security work.

The pairing is telling. One post argues that agents can do security tasks; the other ships a control for restricting what agents are allowed to touch. Both rest on the same assumption, which is that an agent's connections to external systems are the part of the stack that needs watching.

Governance tooling for MCP is a young category, and vendor announcements at this stage tend to describe capability rather than measured outcomes. Snyk's post does not include figures on detection rates, deployment scale or customer results. Teams already running AI coding agents in production will want to establish, before anything else, how many MCP servers are in use across their own estate — a number most organisations currently cannot produce.