The Netskope One Agentic Broker Dashboard for Securing MCP provides visibility into Model Context Protocol (MCP) activity to remote MCP servers from MCP clients in your enterprise. An MCP client can exist on its own, be a part of an AI Agent, or a Generative AI host application. It enables security teams to monitor AI-agent interactions with remote MCP servers — including which MCP clients are making requests, which servers are handling them, which tools are being invoked, and whether any policy actions have been triggered.
The dashboard is built on top of Netskope Advanced Analytics and is scoped to the “MCP Server” category. By default it covers the last 7 days, though the time period can be adjusted using the global filter controls.
Who is this dashboard for?
- Security Operations teams monitoring AI-agent behavior and policy compliance
- IT Administrators tracking MCP server and client inventory across the enterprise
- Compliance Officers auditing tool invocations and data access patterns initiated by AI agents
- Security Engineers investigating specific sessions or policy violation events
Global Filters
Before reading any widget, note the active filter context displayed at the top of the dashboard. All metrics and charts are scoped to these filters simultaneously.
| FILTER | DESCRIPTION |
|---|---|
| Event Period | Rolling window for all data (default: last 7 days). Adjustable to custom date ranges. |
| Category | Fixed to MCP Server for this dashboard. Scopes all events to MCP protocol interactions only. |
| MCP Activity | Filter for MCP activities that can be adjusted based on your needs. |
| MCP Client Name | Filter for MCP client names that can be adjusted based on your needs. |
| MCP Server Name | Filter for MCP server names that can be adjusted based on your needs. |
Dashboard Sections
The dashboard is divided into five sections: Overview, Servers, Clients, Tools, and Sessions. Each section groups related widgets by the entity being examined.
Overview
The Overview section surfaces the most important enterprise-wide summary metrics. These counters update in near real-time and give a quick health-check of all MCP activity within the selected period.
| WIDGET | CHART TYPE | KEY METRIC | INSIGHT PROVIDED |
|---|---|---|---|
| Total MCP Sessions | Counter | COUNT DISTINCT(mcp_session_id) | Total number of distinct MCP sessions initiated in the period. A session groups all events between a single client-server negotiation. |
| Active MCP Servers | Counter | COUNT DISTINCT(mcp_server) | Number of unique MCP servers that handled at least one request. Use this to track inventory growth over time. |
| Active MCP Clients | Counter | COUNT DISTINCT(mcp_client) | Number of distinct MCP client applications (e.g. Postman, Claude Desktop, Cursor) seen in the period. |
| Blocked Policy Actions | Counter | COUNT(action = Block) | Number of requests that were blocked by a Netskope policy. A value of 0 indicates no blocks in this period — but verify that alert-only policies are also reviewed. |
| Active Human Users | Counter | COUNT DISTINCT(user) | Distinct users whose identity was associated with at least one MCP session in the period. |
| # Sessions by MCP Protocol Version | Pie Chart | % share per mcp_server_protocol_version | Shows which version of the MCP protocol each server is running. Servers on older protocol versions (shown as ∅ / null) may lack newer security capabilities. For example, undetected version — indicating incomplete server registration or unmanaged servers. |
| Total #Tool Requests | Counter | COUNT(mcp_activity events) | Total number of individual tool request events. |
| Total #Prompt Requests | Counter | COUNT(mcp_activity events) | Total number of individual prompt request events. |
| Total #Resource Requests | Counter | COUNT(mcp_activity events) | Total number of individual resource request events. |
| Total #Tool Requests Trend Over Time | Trend Line Chart | Sessions per day | This trend chart shows how frequently the tool requests are used over the selected time period. It is the primary widget for understanding request usage patterns and spotting unusual spikes. |
| Total #Prompt Requests Trend Over Time | Trend Line Chart | Sessions per day | This trend chart shows how frequently the prompt requests are used over the selected time period. It is the primary widget for understanding request usage patterns and spotting unusual spikes. |
| Total #Resource Requests Trend Over Time | Trend Line Chart | Sessions per day | This trend chart shows how frequently the resource requests are used over the selected time period. It is the primary widget for understanding request usage patterns and spotting unusual spikes. |
Servers
The Servers section provides a multi-angle view of MCP server activity: protocol inventory, invocation frequency, usage trends over time, and the specific policy actions taken against each server.
| WIDGET | CHART TYPE | KEY METRIC | INSIGHT PROVIDED |
|---|---|---|---|
| Top 10 Most Invoked MCP Servers | Horizontal Bar Chart | Session count per mcp_server_name | Ranks servers by number of sessions in descending order. Use this to identify the most-used servers and to prioritize security review effort accordingly. |
| Trend of Server Usage Over Time | Multi-series Line | Daily sessions per mcp_server_name | Tracks how each server’s session volume changes day by day. Diverging or crossing lines indicate shifting workloads. Servers with sudden spikes should be correlated against the Policy Actions table. |
Clients
The Clients section maps client applications to the servers they connect to and tracks traffic volumes over time. This section is essential for understanding the full client-to-server relationship graph in your enterprise.
| WIDGET | CHART TYPE | KEY METRIC | INSIGHT PROVIDED |
|---|---|---|---|
| MCP Client List | Table | Sessions per mcp_client_name | A flat inventory of all observed MCP clients with their session counts. Use this as a starting point for client audits — any client not in your approved list should be flagged. |
| MCP Client Traffic Over Time (#Sessions) | Trend Line Chart | Daily sessions stacked per client | Shows how overall client-side traffic evolves day by day, broken down by client type. A growing stack indicates increased AI-agent usage across the enterprise. |
Tools
The Tools section provides granular visibility into which MCP tools are being invoked, how frequently, and at what rate over time. Tools are the atomic units of MCP server action — monitoring them closely is critical to understanding what MCP servers are actually doing.
| WIDGET | CHART TYPE | KEY METIC | INSIGHT PROVIDED |
|---|---|---|---|
| Top Used Tools | Bar Chart | Event count per mcp_tool_name | Ranks tools by total invocation count. The null tool (87 events) vastly outnumbers all named tools, indicating either a large volume of unclassified tool calls or events where the tool name was not captured. |
| Rates of Requests per Tool | Trend Line | Events per day per tool (activity = CallToolRequest) | Tracks invocation rate for each tool over time. Useful for detecting unusual acceleration in a specific tool’s usage, which may indicate automated or looping agent behavior. |
Key Data Fields
All widgets in this dashboard are derived from a set of structured MCP event fields captured by the Netskope Agentic Broker. The table below maps the most important fields to the widgets that use them.
| FIELD | DATA TYPE | USED IN |
|---|---|---|
| MCP Activity | STRING | Total #Tool Requests, Total #Prompt Requests, Total #Resource Requests, Total #Tool Requests Trend Over Time, Total #Resource Requests Trend Over Time, Total #Prompt Requests Trend Over Time |
| MCP Tool Name | STRING | Top Used Tools for the Server, Rates of Requests to Each Tool |
| MCP Client | STRING | Active MCP Clients, Usage of MCP Clients, MCP Client List, MCP Client Traffic Over Time (#Sessions) |
| MCP Server | STRING | Active MCP Servers, Top 10 Most Invoked MCP Servers, Trend of MCP Server Usage Over Time, Rates of Requests to Each Tool |
| MCP Protocol Version | STRING | MCP Servers by Protocol Version |
Interpreting Null / ∅ Values
Several widgets in the sample dashboard display ∅ (null) values for server names, client names, or tool names. Understanding what these mean is important for accurate interpretation.
| NULL FIELD | LIKELY CAUSE |
|---|---|
| MCP Server | 1) MCP server names are captured only in responses. For request related activities, e.g. "InitializeRequest," MCP server names will be null. 2) Traffic is detected but the server cannot be identified. Treat as shadow MCP server and investigate. |
| MCP Client | 1) MCP client names are captured only in requests. For response related activities, e.g. "InitializeResult," MCP client names will be null. 2) Client application did not provide an identifying name during the MCP handshake, or the client is not in the Netskope client catalogue. May indicate a custom or unmanaged agent. |
| MCP Server Version | The protocol version was not negotiated or not captured. Servers showing ∅ here should be prioritized for registration and version upgrade. |
To Learn More:
- Netskope Agentic Broker
- Advanced Analytics
- MCP Security Policy
- Contact your Netskope account team or open a support ticket at support.netskope.com for assistance with the Agentic Broker Dashboard for securing MCP