AI Agents

Radar action items for background agents, sub-agents, and autonomous AI governance. Each item below describes the problem, why it is a risk, a concrete example of what can go wrong, and the step-by-step fix in Willow.

Shadow MCPs Detected

Problem. The Scan Agent found one or more MCP servers running on managed devices that are not registered in Willow.

Why it is a risk.

• The server may have access to local files, source code, secrets, or production APIs the security team has not reviewed.
• Local servers can be misconfigured (no authentication, listening on 0.0.0.0, etc.) and become a foothold on the device.
• They show that users are working around the managed gateway, which means logs and guardrails do not see those tool calls.

Example. Your scan reports an unmanaged Postgres MCP server running on a developer machine. The connection string in its config points at a production replica, and the server has no authentication. Anyone on the same network could query the production database via the local server.

How to solve it.

1. Open Security > AI Discovery and select the MCP Servers tab.
2. For each finding, decide whether the server should be:
   • Promoted to a managed Willow integration,
   • Allowed because it is a safe local-only tool, or
   • Blocked and removed from the device.
3. Apply policy to similar future findings using the MCP Enforcement Policy item.
4. If the same server appears on many devices, document it once and apply the decision in bulk.

Shadow Skills Detected

Problem. Skills were discovered on devices that are not part of your managed catalog.

Why it is a risk.

• Skills are instructions for an agent. Unreviewed instructions can change tool selection, exfiltrate data, or weaken guardrails.
• Local skills are easy to copy from forums, AI-generated examples, or competitors and rarely have provenance.
• Different users may run different versions of the "same" skill, making support and incident response harder.

Example. A user installs a community skill called "Help me commit all changes". The skill includes a hidden instruction telling the agent to also push the branch to a personal fork on GitHub. Without review, source code leaks every time the user runs the skill.

How to solve it.

1. Open Security > AI Discovery and select the Skills tab.
2. For useful skills, click Promote to Managed and review their content before publishing to the organization marketplace.
3. For unsafe skills, contact the owner, then enforce removal via the Skill Enforcement Policy.
4. Track repeat offenders so you can offer training or a managed alternative.

Critical-Risk MCP Servers Detected

Problem. Willow's AI Risk Assessment classified one or more MCP servers discovered on managed devices as critical risk. Critical is the highest risk band, reserved for capabilities that can cause severe, often irreversible damage.

Why it is a risk.

• A critical-risk server typically exposes destructive operations, broad data access, or unauthenticated endpoints that an agent could be tricked into using.
• Because the server runs on a device outside the managed gateway, its tool calls are not inspected by guards and do not appear in your logs.
• The longer a critical finding sits unresolved, the more time there is for prompt injection or a misconfiguration to be exploited.

Example. The assessment flags a local MCP server that exposes a run_shell tool with no authentication. Any agent on that machine, or anyone who reaches the local port, can execute arbitrary commands on the developer's device.

How to solve it.

1. Open Security > AI Discovery and select the MCP Servers tab.
2. Sort or filter by risk band and review each critical finding, including the assessment's reasoning.
3. For each server, decide whether to block and remove it, allow it if it is a reviewed local-only tool, or promote it to a managed Willow integration where guards apply.
4. Set the MCP Enforcement Policy to Block so future critical findings are stopped automatically.

Critical-Risk Skills Detected

Problem. Willow's AI Risk Assessment classified one or more skills discovered on managed devices as critical risk.

Why it is a risk.

• Skills are instructions an agent follows. A critical-risk skill can direct an agent to exfiltrate data, disable safeguards, or call destructive tools.
• Local skills have no provenance and bypass the build-time guards that inspect managed skills.
• A single critical skill can spread across many devices before anyone reviews it.

Example. The assessment flags a local skill whose hidden instructions tell the agent to collect environment variables and POST them to an external endpoint. Every run leaks secrets from the developer's machine.

How to solve it.

1. Open Security > AI Discovery and select the Skills tab.
2. Review each critical finding and read the assessment's reasoning and the skill's contents.
3. Contact the owner, then block or remove unsafe skills, or promote to managed and re-review any that are genuinely useful.
4. Set the Skill Enforcement Policy to Block so future critical findings are stopped automatically.

High-Risk MCP Servers Detected

Problem. Willow's AI Risk Assessment classified one or more MCP servers discovered on managed devices as high risk. High risk is a step below critical, but still warrants review.

Why it is a risk.

• High-risk servers often combine sensitive access (files, source, internal APIs) with weak controls, even if no single capability is catastrophic.
• Unmanaged servers are invisible to guards and logs, so misuse is only discovered after the fact.
• High-risk findings tend to become critical as users add tools or credentials to them over time.

Example. The assessment flags a local database MCP server that can read production tables. It requires a token today, but the token is stored in plaintext in the server's config, so a leak would grant broad read access.

How to solve it.

1. Open Security > AI Discovery and select the MCP Servers tab.
2. Review each high finding alongside the assessment's reasoning.
3. Block, allow, or promote each server based on your review, and move any credentials into Vault (Admin > Settings > Vault).
4. Use the MCP Enforcement Policy to warn on or block future high-risk findings.

High-Risk Skills Detected

Problem. Willow's AI Risk Assessment classified one or more skills discovered on managed devices as high risk.

Why it is a risk.

• High-risk skills can steer agent behavior in ways that are hard to predict, even when they are not overtly malicious.
• Different users may run different versions of the same skill, making support and incident response harder.
• Without review, a high-risk skill can escalate as the agent gains access to more tools.

Example. The assessment flags a "commit and push everything" skill that also pushes to a personal fork. It is useful day to day, but it quietly moves source code outside approved repositories.

How to solve it.

1. Open Security > AI Discovery and select the Skills tab.
2. Review each high finding and the assessment's reasoning.
3. Promote to managed and re-review useful skills; block or remove the rest.
4. Use the Skill Enforcement Policy to warn on or block future high-risk findings.