This spotlight is part of our MCP company spotlights, within The MCP Guide. Building an MCP company? See SEO and GEO for MCP companies.
Astrix Security sells a platform for securing non-human identities (NHIs), such as API keys, service accounts and AI agents. For MCP, Astrix discovers the MCP servers in use across a company, including unapproved "shadow" ones, and maps what each can reach. It also publishes MCP Secret Wrapper, a free tool that pulls secrets from a vault instead of a config file.
Checked against: Astrix's AI agent discovery page on 28 October 2026. eSEOspace did not test Astrix Security's products.
Key Takeaways
- Astrix says it builds a real-time inventory of AI agents, "both managed and shadow MCP servers," NHIs and secrets.
- Its Identity Graph maps agents and MCP servers to permissions, owners and the resources they reach.
- MCP Secret Wrapper is open source (Apache-2.0) and supports AWS Secrets Manager, GCP Secret Manager and Azure Key Vault.
- Astrix's October 2025 research found 88% of MCP servers need credentials and 53% rely on static keys or tokens.
- Astrix does not publish pricing; you book a demo.
At a glance
| Company | Astrix Security |
|---|---|
| What it offers for MCP | Discovery and risk scoring of MCP servers; Agent Control Plane; MCP Secret Wrapper |
| Who it's for | Security teams governing AI agents and machine identities |
| Open source? | MCP Secret Wrapper is open source (Apache-2.0); the platform is commercial |
| Pricing | No public pricing; demo request |
What Astrix Security offers for MCP
Discovery and inventory
Astrix's discovery page says it "connects to your environment in minutes" and maps:
- AI agents, whether custom, third-party or home-grown.
- Managed and shadow MCP servers.
- NHIs, such as service accounts, OAuth apps, API keys, SSH keys and IAM roles.
- Secrets, inside and outside your vaults.
Each item gets a risk score based on access, behavior and security findings. Astrix's Identity Graph shows links between agents, MCP servers, secrets, permissions and owners. It also maps each agent to a responsible human owner.
This answers a basic governance question: which MCP servers are your staff using, and what can they touch? Our MCP governance guide for IT leaders explains why that matters.
Agent Control Plane
Astrix's Agent Control Plane (ACP) provisions new agents with "policy-driven, short-lived credentials" and scoped, just-in-time access. Developers pick a pre-approved permission profile, and security admins see the agent in Astrix's inventory with its policies attached. The ACP page does not describe MCP-specific features beyond the shared inventory.
MCP Secret Wrapper
Many local MCP servers read an API key from a config file. The MCP Secret Wrapper wraps any MCP server and fetches the secret from a vault when the server starts. The README says it lets you "securely inject secrets from vault systems into MCP (Model Context Protocol) servers without exposing credentials in configuration files."
You run it with npx, list the secrets to inject, and put the original server command after a -- separator. As of October 2026, AWS Secrets Manager, GCP Secret Manager and Azure Key Vault are supported, and HashiCorp Vault is in progress. Astrix's announcement calls the tool a way to "eliminate hard-coded credentials." It does not make a key less powerful or shorter-lived, so pair it with narrow scopes.
Research
Astrix's State of MCP Server Security 2025 studied 5,205 open-source MCP server repositories. It found that 88% require credentials and 53% rely on static API keys or personal access tokens.
Who it's for
Astrix fits mid-size and large companies with many machine identities and growing AI use. Its main users are security teams that need an inventory before they can set policy.
The Secret Wrapper suits any developer who runs local MCP servers with API keys. See our guide to MCP secret leakage for the risk it addresses.
Pricing
Astrix does not publish pricing on its website as of October 2026. The site directs buyers to book a demo. The MCP Secret Wrapper is free and open source under Apache-2.0.
Security and trust
The Astrix pages we opened on 28 October 2026 did not list security certifications. Ask Astrix for its compliance reports during evaluation, and use our vendor security questionnaire.
Alternatives
- Aembit offers an MCP Identity Gateway that keeps credentials away from agents.
- Lasso Security offers MCP server discovery plus runtime threat detection.
- Invariant Labs, now part of Snyk, offers scanning and runtime guardrails.
Next step
Start with an inventory of the MCP servers your team already uses. Our MCP security checklist gives you the steps. Then compare vendors in our MCP companies hub.
Frequently asked questions
What is a shadow MCP server?
It is an MCP server someone connected without security approval. Astrix says its discovery covers both managed and shadow MCP servers.
What does MCP Secret Wrapper do?
It wraps an MCP server and fetches secrets from a vault at startup, so keys are not written in plain text in your MCP config. It is open source under Apache-2.0.
Which vaults does MCP Secret Wrapper support?
The README lists AWS Secrets Manager, GCP Secret Manager and Azure Key Vault as supported, with HashiCorp Vault in progress, as of October 2026.
How much does Astrix cost?
Astrix does not list prices on its website. You request a demo for a quote. The MCP Secret Wrapper is free.
