Passenger
repo-search-mcp
- Found in
- Cursor
- Can reach
- src/
- Score
- 94
✓ LOW RISK
Gate 01 · Discovery Scan
The no-fly list for AI agents.Shadow AI discovery for agents, MCP servers, and tools.
NoFly is a shadow AI discovery tool built for AI agents. It finds every agent, MCP server, and tool running in your org, and shows which ones are risky before they cause a problem.
Passenger
pdf-wizard-mcp
- Found in
- Claude Code
- Can reach
- .env
- Score
- 12
✕ NOFLY
LIST
Passenger
shell-helper
- Found in
- Internal bot
- Can reach
- terminal
- Score
- 51
△ REVIEW
Finds agents from
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- OpenAI Codex
What a shadow AI discovery tool should find
Developers add AI agents and MCP servers every day, usually without telling security. A NoFly Discovery Scan shows you all of it in one place.
Every agent
Coding assistants, internal bots, and the shadow AI nobody signed off on, with who runs each one and where.
Every MCP server and tool
Each server your agents connect to, and exactly what it can touch: files, secrets, the terminal, the network.
The risk in each one
A score for every tool, checked against the NoFly list, with a plain explanation of why it's risky and what to do.
How a scan works
From connect to report, in three steps.
- 1
Connect
Link your repos, dev machines, or identity provider. Read-only.
- 2
Scan
NoFly finds every agent and tool, then checks each one against the NoFly list.
- 3
Review
Get a report ranked by risk, with the fix for each finding and a summary you can share upward.
Discovery scan report
Example Co.
Sample
- pdf-wizard-mcp can read .env and call unknown hosts✕ NoFly list
- shell-helper has full terminal access△ Review
- repo-search-mcp reads source code only✓ Low risk
Passport control · Free
Is this MCP server on the NoFly list?
Look up any server before your agents load it. Public scores, no signup.
What's next
Screen is live. Clear and Ground are next.
Discovery is the first checkpoint. Next, NoFly will let you set policy for every agent and stop risky actions while they run.
Checkpoint 1
Screen
Find and score every agent and tool.
✓ LIVE
Checkpoint 2
Clear
Approve and deny tools with one policy.
◷ COMING
SOON
SOON
Checkpoint 3
Ground
Stop risky actions while agents run.
◷ COMING
SOON
SOON
Questions about shadow AI and MCP servers
What does a shadow AI discovery tool find?
A shadow AI discovery tool finds the AI agents and tools people use at work without security sign-off. Many watch browser and SaaS traffic, which catches chat apps. NoFly also looks inside developer tooling, where coding agents like Claude Code and Cursor load MCP servers that can reach files, secrets, and the terminal.
What is shadow AI?
Shadow AI is any AI agent or tool people use at work without the security team knowing about it. A NoFly Discovery Scan finds these agents and the MCP servers they connect to, so you can decide what stays.
What is an MCP server, and why is it a risk?
An MCP server gives an AI agent new abilities, like reading files, running commands, or calling an API. A malicious or careless server can make an agent leak secrets or take actions nobody approved, and most security tools never see it because it happens inside the agent.
How do I know if an MCP server is safe?
Look at what it can reach (files, secrets, the terminal, the network), who publishes it, and whether it sends data anywhere it does not declare. The NoFly list runs these checks for you and gives each server a public risk score.
Does the scan change anything on our machines?
No. The Discovery Scan is read-only. It reports what it finds and leaves your agents, tools, and settings as they are.
Which agents can NoFly find?
Coding assistants such as Claude Code, Cursor, GitHub Copilot, Windsurf, and OpenAI Codex, plus internal agents and bots that connect to MCP servers.
Is the NoFly list free?
Yes. Anyone can look up an MCP server on the NoFly list and see its risk score, with no signup and no install.