> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/vibesec/vibesec-evaluation/evaluate-vibesec-mcp-ai-bom-governance.md).

# Evaluate VibeSec AI BOM Governance

You can evaluate how VibeSec helps organizations gain visibility into the MCP (Model Context Protocol) servers used by AI coding assistants and control how those MCP servers and tools are used.

During this evaluation, you explore the following key AI BOM capabilities:

* [**Visibility:**](#visibility) Discover the MCP servers used by you or your organization and review their activity.
* [**Governance:**](#governance) Control access to MCP servers and individual MCP tools and verify that AI assistants enforce your organization's policy.

Before you begin your VibeSec evaluation, [check the installation and the Activity Log functioning](/vibesec/vibesec-evaluation/before-vibesec-evaluation.md).

## Visibility

The Agent AI BOM provides visibility into the MCP servers used by AI coding assistants across your organization.

After an AI assistant invokes an MCP server, VibeSec discovers the MCP server and collects information such as its usage, available tools, and users. You can use this information to understand which MCP servers are being used and how they are being accessed.

### Review MCP activity

1. In your AI coding assistant, submit a prompt with the action that you want. For example, in case you're using the Atlassian MCP: `Get me my open Jira tickets.`
2. Verify that the AI assistant successfully performs the required action; in our example, it was supposed to retrieve the Jira tickets.
3. In the OX platform, go to **OX.VibeSec** > **AI Inventory:** **MCPs**.

<figure><img src="/files/9zqZV1CsLWNnv3Xk8W5v" alt="" width="563"><figcaption></figcaption></figure>

4. Locate the MCP server that is relevant to your request and select; in our example, it is the **Atlassian** MCP server.
5. Review the information collected for the MCP server you selected: the tool that was used and the user details.

<figure><img src="/files/F5sPVGek5LmWT2nZA3jZ" alt="" width="563"><figcaption></figcaption></figure>

## Governance

The Agent AI BOM enables administrators to control how AI assistants use MCP servers.

You can enable or disable an entire MCP server, or allow the MCP server while restricting access to selected MCP tools. When an AI assistant attempts to invoke a blocked MCP tool, VibeSec prevents the request from reaching the MCP server and records the event in the Agent Activity Log.

### Restrict access to an MCP tool

1. Go to **AI Inventory > MCPs**, and open the MCP server.
2. Select the **Tools** tab.
3. For this example, disable the MCP tool used to retrieve Jira issues: `searchJiraIssuesUsingJql`

<figure><img src="/files/CoyL8LxDOaR4apJw4njX" alt="" width="563"><figcaption></figcaption></figure>

3. Verify that the MCP status changes to **Allowed with some tools blocked**.

<figure><img src="/files/FEHQarp4bQFXF1b1KUF4" alt="" width="563"><figcaption></figcaption></figure>

### Verify policy enforcement

1. Run the same prompt that uses the blocked MCP tool; in our example, the request is `Get me my open Jira tickets`.
2. Verify that the AI assistant reports that the MCP request was blocked by your organization's policy.

<figure><img src="/files/ANKqhDIEtFAf3oNcZPqR" alt="" width="563"><figcaption></figcaption></figure>

### Review the blocked activity

1. Go to **OX.VibeSec > Agent Activity Log**.
2. Locate the blocked MCP request.
3. Review the recorded activity.

### Restore access

1. In the MCP details dialog, enable the MCP tool.

<figure><img src="/files/xnTqK2MKbRtbxRNwsGR2" alt="" width="420"><figcaption></figcaption></figure>

2. Run the same request again.
3. Verify that the AI assistant successfully completes the request.

For example, rerun: `Get me my open Jira tickets`. The request succeeds after the tool is re-enabled.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ox.security/vibesec/vibesec-evaluation/evaluate-vibesec-mcp-ai-bom-governance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.