Agent AI BOM: MCP Servers
On the MCP Servers tab of the Agent AI BOM page, you can track which MCP servers agents connect to, which tools those servers expose, how frequently they are used, and the developers who use them.
Reviewing this list lets you confirm that only approved MCP servers are in use, identify newly added or unexpected MCP servers, and determine which developers are responsible for each connection so you can follow up where appropriate.
Summary tiles at the top of the tab show totals for MCP servers, active users, and calls within the current scope.
Table columns
Name
The name of the MCP server.
Type
The connection type of the MCP server. Common values are http and plugin.
Identifier
The unique value OX uses to identify the MCP server. This is typically the MCP endpoint URL, a plugin identifier, or another unique ID.
Total Users
The number of distinct developers in your organization who have called this MCP server.
Total Calls
The total number of tool calls made through this MCP server.
First Seen
When OX first recorded a call to this MCP server.
Last Activity
When the most recent call was recorded. Use this to spot MCP servers that are no longer in use, or that were just added.
Filters
MCP Name
Limits the list to selected MCP servers by name.
MCP Identifier
Limits the list by the MCP server's identifier, which is typically the MCP endpoint URL or a vendor-supplied identifier string.
User
Shows only MCP servers used by selected developers.
Tool Name
Shows only MCP servers that expose the selected tool. Useful for finding every MCP server that exposes a specific capability, such as a write tool.
Reviewing MCP server activity
The Explore tab provides an overview of how an MCP server is used across your organization. Use this view to understand adoption, identify the most frequently used tools, and determine which developers rely on the MCP server most heavily.
Summary metrics
Provides a quick overview of MCP server activity within the current scope, as follows:
• Total Calls: The total number of tool invocations made through the MCP server.
• Total Users: The number of developers who used the MCP server.
Most Used Tools
Shows the most frequently used tools exposed by the MCP server.
Using this section, you can: • Quickly identify the tools developers use most often. • Understand the primary use cases of the MCP server. • Spot heavily used tools that may warrant closer review.
To view all tools exposed by the MCP server, select View All.
Most Active Users
Shows the developers who generated the most MCP activity.
Using this section, you can:
• Identify which developers rely most heavily on the server.
• Investigate unusual usage patterns.
To view all users who accessed the server, select View All.
Blocking tools
You can prevent AI coding agents from using tools whose access scope is not appropriate for your organization. For example, you might block tools that can access sensitive systems, perform administrative actions, or expose data that developers should not be able to retrieve through AI agents.
When you block a tool, OX intercepts and denies future attempts to invoke that tool. The block can apply to a single tool, multiple tools, or all tools exposed by a specific MCP server.
From the developer's perspective, the tool becomes unavailable. If the agent attempts to invoke a blocked tool, the request is denied, and the action is not performed.
Each block is recorded on the Prevented Risks page, where you can review which tools were blocked, for which developers, and when.
To block a tool:
Go to Agent AI BOM > MCP Servers.
Select the required MCP server.
Open the Tools tab.
Locate the tool you want to restrict.
To block the tool, turn off its toggle.
After a tool is blocked, OX records each blocked invocation attempt on the Prevented Risks page. You can review which tool was blocked, which developer attempted to use it, and when the attempt occurred.
Last updated