MCP Server Approval Registry + Typosquat Check

Control objective

MCP Server Approval Registry and Typosquat Check verifies that every Model Context Protocol server an agent connects to is explicitly approved for the tenant and is not an impostor with a look-alike name. It matters because agents gain capabilities by connecting to MCP servers, and a malicious or spoofed server — for example 'paymets-api' masquerading as the legitimate 'payments-api' — can hijack the agent's actions; this is the supply-chain risk addressed by the Cisco MCP Scanner, OWASP ASI04 and NIST Cybersecurity guidance. To implement, maintain a tenant allowlist that pins each approved server by name plus SHA hash plus version, refuse connections to any server not on the allowlist, and run a Levenshtein-distance typosquat check that flags newly seen server names that are suspiciously close to approved ones; quarantine any new or changed server for an observation period before it can be used, and log every connection attempt, hash match and typosquat score as evidence. There is no numeric metric or formula, so operate to the stated threshold: 100% of MCP servers must be on the tenant allowlist (name+SHA+version), a Levenshtein typosquat check must run, and unknown servers face a 7-day quarantine. Any unapproved server, hash mismatch or typosquat hit is a Critical-priority breach that blocks the connection and triggers review.