Shadow Connectors: The MCP Integrations Nobody Approved
Every developer can wire an AI client into production systems in an afternoon. Most enterprises now have more unofficial connectors than sanctioned ones — and no inventory of either.
The connector ecosystem solved a genuine problem: getting an assistant to actually do things in the systems people use. It also made it trivial for one engineer to grant a model standing access to a production database, a ticketing system and a cloud account — from a laptop, with a personal token, in an afternoon.
Why this is different from classic shadow IT
A shadow SaaS tool holds a copy of some data. A shadow connector holds live, authenticated write access to your systems of record — and it is driven by a model that can be influenced by text it reads. The blast radius is not a spreadsheet; it is your production estate.
The four risks in order of how often we find them
- Over-scoped tokens. The connector was set up with an admin credential because narrowing scopes was fiddly and it was "just a test".
- Personal credentials. Access is bound to an individual, so it survives their role change and disappears silently when they leave.
- Unvetted third-party servers. A community connector pulled from a public registry, running with the same trust as an internal one, updating itself on restart.
- No egress control. The connector host can reach the internet, so a successful injection has a delivery path.
A pragmatic programme
Inventory first, policy second
You cannot govern what you cannot list. Discovery through egress logs, OAuth grant audits and endpoint process inventory gives you the real picture within a week. Policy written before that picture will be ignored.
An approved connector gateway
One brokered path to production systems, with service identities instead of personal tokens, per-tool scoping, rate limits and full call logging. Make the sanctioned route faster than the DIY one and shadow adoption drops on its own.
Scope by capability, not by system
"Read tickets" and "close tickets" are different grants. Most connector configurations conflate them because the underlying API token does.
Review connectors like third-party code
Pin versions, review the source, and require a named owner who re-attests every quarter.
An unapproved connector is not a productivity shortcut. It is an unreviewed, permanently authenticated integration into production.
