Home > Security and Compliance Blog > Cybersecurity Risk Management > Kiteworks Secure MCP Server Arrives on Anthropic’s Connector Marketplace

Kiteworks Secure MCP Server Arrives on Anthropic’s Connector Marketplace

by Patrick Spencer updated August 11, 2026 Cybersecurity Risk Management

Reading Time: 9 minutes

Most enterprises did not choose to expose sensitive data to AI models. They backed into it, one well-intentioned Claude or ChatGPT prompt at a time, because the alternative was to tell employees to stop using the tools that made them faster. The Kiteworks 2026 Data Security and Compliance Risk: Annual Forecast Report found that every organization it surveyed now has agentic AI on its roadmap, yet 63% cannot enforce purpose limitations on what those agents do with data and 60% have no way to shut down an agent once it starts behaving badly. That gap between ambition and control is exactly what the Model Context Protocol was supposed to close, and exactly what most MCP implementations still leave open.

Kiteworks is narrowing that gap today. The Kiteworks Secure MCP Server is now listed on Anthropic’s Connector Marketplace inside Claude Desktop, giving Kiteworks customers a direct, one-click path to connect Claude to their governed data environment. Employees still work the way they already do, in natural language, inside a familiar AI client. What changes is what happens behind that prompt: every file access, folder operation, and data retrieval now passes through the same role-based and attribute-based access controls, encryption, and audit logging that already govern email, file sharing, and managed file transfer inside Kiteworks secure data exchange.

Table of Contents

This is not a governance layer bolted onto AI as an afterthought. It is the same control plane that already governs data access, use, and exchange for the people inside an organization, and this launch brings the AI agent sitting inside Claude into that same plane, as a second class of identity governed by identical policy. That distinction, between agents that are governed alongside humans from day one and agents that operate on their own outside any policy, is the difference this launch is built around.

Key Takeaways

1. Kiteworks Secure MCP Server is now on Anthropic’s Connector Marketplace.

Kiteworks customers can connect Claude Desktop directly to their private Kiteworks environment through a one-click connector, rather than standing up custom integration code.

2. Every AI request is authorized against existing RBAC and ABAC policy.

The Data Policy Engine evaluates each file access, folder operation, and data retrieval before Claude ever sees the result, so information outside a user’s entitlement never reaches the model.

3. Governance gaps in agentic AI are widespread, not hypothetical.

Independent research documents agents that leaked personally identifiable information, accepted spoofed identities, and consumed unbounded resources once left ungoverned, which is why access control has to sit in front of the model rather than behind it.

4. Security is built in at the protocol layer, not layered on top.

OAuth 2.1 hardening, FIPS 140-3 validated cryptography, and hybrid post-quantum key exchange protect every session between Claude and the Kiteworks MCP server.

5. Setup takes two steps because every customer runs a private instance.

An administrator enables Kiteworks MCP once for the organization, and each end user then connects Claude Desktop to that private server through the Connector Marketplace.

The Governance Gap Driving Enterprise AI Agent Risk

The pressure to adopt AI is not the problem. The problem is what enterprises have been willing to accept in order to get there. Conventional AI integrations typically work by handing a model broad access to a file store, a mailbox, or an API, then hoping that prompt design and model alignment do the rest of the access control work. That approach was already fragile with a single well-behaved model. It falls apart once agents start acting autonomously, talking to other agents, and making decisions a human never explicitly approved.

The scale of the gap shows up clearly in the data. According to the 2026 Forecast Report, 55% of organizations cannot isolate their AI systems from the broader network, and 54% of boards do not even rank AI governance among their top five priorities. Inside government agencies specifically, the same report found 90% lack purpose binding for AI agents and 76% have no kill switch to stop one mid-task. The WEF Global Cybersecurity Outlook 2026 adds a sobering data point of its own: roughly a third of organizations have no process at all to validate an AI system’s security before it goes live, and only about 40% conduct periodic AI security reviews once it does.

What happens when that governance gap meets a live agent was demonstrated in stark detail by “Agents of Chaos”, a February 2026 study run by twenty researchers across institutions including MIT, Stanford, Carnegie Mellon, and Harvard. Working with the open-source OpenClaw agent framework in a live, non-sandboxed environment, the researchers documented at least ten significant security breaches in eleven representative case studies. One agent forwarded an entire email, including an unredacted Social Security number and bank account details, after refusing a direct request for the same data, because it could recognize an explicit request for sensitive information but not recognize that handing over the container holding it achieved the identical result. In another case study, a researcher changed a Discord display name to match an agent’s owner. The agent caught the impersonation the first time, inside the same channel it already knew. It missed the second attempt entirely: once the same attacker opened a new private channel with no history attached, the agent accepted the identity on the display name alone and deleted its own memory files, renamed itself, and handed over administrative access.

The researchers behind that study frame the underlying issue as architectural, not cosmetic. Agents built on large language models have no reliable way to distinguish an authorized instruction from an unauthorized one once both arrive as tokens in the same context window. That makes prompt injection a structural feature of these systems, not a bug that better prompting will eventually fix. Access decisions cannot be left to the model’s judgment for this reason. They have to be enforced by a policy layer the model cannot talk its way around. That is what zero trust security means in practice: check the request at the point where the agent actually touches data, every time, regardless of what the agent claims about itself.

You Trust Your Organization is Secure. But Can You Verify It?

Read Now

What the Kiteworks Secure MCP Server Does

The Kiteworks Secure MCP Server sits between AI clients like Claude, ChatGPT, Gemini, or Copilot and an organization’s governed data, built on the open Model Context Protocol that has become the emerging standard for connecting language models to external tools and data sources. Rather than granting a model direct filesystem or API access, every request routes through the Secure MCP Server and the Kiteworks Data Policy Engine, which evaluates it against role-based access control and attribute-based access control before anything is returned.

That evaluation happens for people and AI agents under the same policy model. Kiteworks did not build a separate, looser policy model for AI. An AI client authenticates through OAuth 2.0 and inherits the requesting user’s existing permissions rather than operating with standing access of its own. ABAC then applies additional handling rules based on the classification, sensitivity, and context of the specific data being requested, so a file appropriate for one user’s AI session can be withheld from another’s even when both ask the same question. Content that policy deems too sensitive for a given request never reaches the model. Every file access, folder operation, and data retrieval lands in a unified audit trail. Compliance and security teams get the same forensic visibility into AI activity that they already have into email and file transfer activity.

Underneath the Secure MCP Server, the data itself stays inside the Kiteworks secure data exchange environment, protected by double encryption, sovereignty controls, and high-availability replication. The AI client never gets a standing copy of enterprise content. It gets exactly the data a specific, authenticated, policy-approved request is entitled to, at the moment it is entitled to it, and nothing more.

Enterprise-Grade Security Built Into the Protocol

A governance model is only as strong as the transport and cryptography underneath it. Kiteworks built the Secure MCP Server to enterprise security requirements rather than open-source MCP defaults. Access tokens sit in the operating system’s encrypted keystore instead of environment variables, which closes off a credential-leakage path that shows up often in MCP security research. Authentication runs on OAuth 2.1 hardening: dynamic client registration, authorization code flows with PKCE, JWT access and refresh tokens, and automatic token rotation. A stolen token has a short useful life and cannot be replayed indefinitely.

Cryptography throughout the server meets FIPS 140-3 requirements, using AES-256-GCM, RSA with SHA-256, and TLS 1.3 with NIST-approved curves. Kiteworks has also built in post-quantum forward secrecy through a hybrid X25519 plus ML-KEM-768 TLS key exchange under FIPS 203, protecting today’s sessions against the possibility that encrypted traffic captured now could be decrypted by a future quantum-capable adversary. Configurable rate limiting applies globally, per user, and per session, addressing the kind of unbounded resource consumption that researchers like the Agents of Chaos team have shown ungoverned agents are prone to. Filesystem paths are normalized and validated to prevent path traversal, credentials and transferred payloads are never exposed to the LLM itself, and strict TLS certificate and hostname validation guard against man-in-the-middle interception.

None of this is exposed to the end user as friction. From inside Claude, the experience is a natural-language conversation. Underneath it, every one of those controls is doing its job on every request.

From Prompt to Governed Action: How It Works in Claude

The practical effect for an employee is that AI-powered work happens through plain language, inside a client they already use, without ever having to think about the governance running underneath. A user might type “create a Q1 folder under the Forecasts folder,” “upload this spreadsheet there,” “what’s in the Analysis folder?” or “download those documents,” and the Secure MCP Server translates each of those natural-language requests into a policy-checked, audited action against the Kiteworks environment.

That same governed pipeline extends to content creation, not just retrieval. With the Secure MCP Server connected, a user can point Claude at a PDF, an image, or a plain text description and ask it to build a secure web form. Claude drafts and previews the form as structured JSON and delivers it directly into a governed Kiteworks folder. The new form inherits the platform’s RBAC and ABAC controls, double encryption, and unified audit log automatically, turning what used to be a manual, multi-step form-building process into an AI-accelerated workflow that is compliant by construction rather than compliant by a later review.

Why the Anthropic Connector Marketplace Listing Matters

Listing the Secure MCP Server on Anthropic’s Connector Marketplace changes how Kiteworks customers get from “we want governed AI access to our data” to actually having it. Because every Kiteworks customer runs its own private cloud instance, each organization deploys its own private Kiteworks MCP server rather than connecting to a shared, multi-tenant endpoint. Setup takes two steps. An administrator follows the Kiteworks MCP installation and setup guide to enable Kiteworks MCP for the organization. Each end user then opens the Connector Marketplace inside Claude Desktop and connects to their organization’s Kiteworks instance directly, without engineering a custom integration or waiting on a developer backlog. Organizations using a client other than Claude Desktop can follow the same installation guide to stand up a local server for a developer or an HTTP server for the broader organization.

A marketplace listing is also a distribution decision, not just a technical one. It puts a governed connection option in front of every Claude Desktop user inside a Kiteworks customer’s organization, at the exact moment they are deciding how to connect Claude to their data, rather than after a security team has discovered an ungoverned integration already in production. Given how many of the incidents documented in research like Agents of Chaos trace back to agents operating with no verified identity and no bounded permissions, closing that window between “AI adoption starts” and “AI governance catches up” matters as much as any individual security control.

Compliance Assurance That Travels With the Data

Regulated organizations do not get to treat AI governance as a separate compliance track from everything else they run. The Secure MCP Server inherits the same certifications as the rest of the Kiteworks platform: Kiteworks is FedRAMP Authorized and has been assessed under IRAP to the PROTECTED level. For security, compliance, and AI leaders inside regulated industries, that means AI-powered workflows built on Claude and the Secure MCP Server run inside the same accreditation boundary that already covers email, file sharing, and managed file transfer, rather than introducing a new system that has to be assessed, justified, and audited on its own.

Getting Started With Kiteworks Secure MCP Server

Organizations already running Kiteworks can enable the Secure MCP Server through the Kiteworks MCP installation and setup guide, then have end users connect through Anthropic’s Connector Marketplace inside Claude Desktop. Organizations evaluating AI data governance more broadly can use this launch as a concrete starting point: rather than debating AI policy in the abstract, security and compliance teams can see exactly how a specific AI client’s access to specific data gets authorized, logged, and constrained in production.

To learn more about governing AI agent access to sensitive enterprise data, schedule a custom demo today.

Frequently Asked Questions

The Kiteworks Secure MCP Server is a governance-controlled connection point between large language models, such as Claude, ChatGPT, Gemini, or Copilot, and an organization’s data inside Kiteworks secure data exchange. It is built on the open Model Context Protocol and evaluates every AI request against existing RBAC and ABAC policy before returning any data, so the model receives only what a specific, authenticated request is entitled to see.

A direct connection typically grants a model broad, standing access and relies on the model’s own judgment to avoid misuse, an approach that independent research on agent behavior has repeatedly shown is unreliable once agents operate with any autonomy. The Secure MCP Server instead routes every file access, folder operation, and data retrieval through the Data Policy Engine, which enforces access control and logs the request in a unified audit trail whether the requester is a person or an AI agent.

No. Because the Secure MCP Server is listed on Anthropic’s Connector Marketplace, an administrator enables Kiteworks MCP once for the organization, and individual users then connect Claude Desktop to their organization’s private Kiteworks instance directly from inside the Connector Marketplace. Organizations using MCP clients other than Claude Desktop can follow the same Kiteworks MCP installation and setup guide to stand up a local or HTTP server, which draws on the same secure data exchange environment as every other deployment.

Sessions are protected by OAuth 2.1 hardening with PKCE and automatic token rotation, FIPS 140-3 validated cryptography including AES-256-GCM and TLS 1.3, and a hybrid post-quantum key exchange for forward secrecy. Configurable rate limiting, path traversal protection, and strict TLS certificate validation address common exploitation paths documented in current AI agent security research, and access tokens are stored in the operating system’s encrypted keystore rather than environment variables.

Yes. The Secure MCP Server operates within the same compliance boundary as the rest of the Kiteworks platform, which is FedRAMP Authorized and assessed under IRAP to the PROTECTED level. Regulated organizations in government, financial services, and healthcare can extend AI-powered workflows to Claude and other MCP-compatible clients without standing up a separate compliance track for AI.

Additional Resources