AI Series

MCP Is About to Become Physical Security’s Newest Silo

Nobody in this industry has shipped an MCP server yet. When everyone does, an agent connected to six of them is not integrated. It is holding six opinions about who a person is.

By Nick Venuti, Senior Director of Product Marketing  ·  August 2026  ·  6 min read

Go through the 2026 announcements from every major access control platform, video management system, visitor system and elevator manufacturer. You will not find a shipped Model Context Protocol server. As of today, MCP in physical security does not exist as a product anyone can buy. The closest thing in the market is Brivo’s AI agent-friendly API, announced in May, and it is explicitly not branded MCP.

That will not be true for long. The shape of it is being decided right now, quietly, mostly by default. We think it is heading somewhere the industry has been before, and we would like to argue about that with you in Atlanta.

The protocol argument is over. The plumbing argument has not started.

MCP stopped being a question about eighteen months ago. Anthropic published it in November 2024. Google committed to it in April 2025, with Demis Hassabis calling it “rapidly becoming an open standard for the AI agentic era.” Microsoft built native support into Windows 11 that May. In December 2025 Anthropic handed the specification to the Agentic AI Foundation under the Linux Foundation, with Block and OpenAI as co-founders and Google, Microsoft, AWS and Cloudflare among the platinum members.

When your competitors co-found a foundation with you, the standards fight is finished. So the interesting question is no longer whether physical security systems will speak MCP. It is what happens the week after they all do.

Everyone else already ran this experiment

General IT is roughly two years ahead of us, which makes it a useful preview. Here is the state of the MCP ecosystem as it stands.

Those three numbers describe the same ecosystem on roughly the same day. The gap between them is not a rounding error, it is the discovery problem in one line. Nobody can tell you how many MCP servers exist, which means nobody inside a large enterprise can tell you how many their organization is quietly connected to.

The market noticed. AWS shipped a gateway in August 2025 framed explicitly around the agent-to-tool integration problem. Kong shipped an enterprise MCP gateway that October, positioned against what it called MCP server sprawl. A control plane category formed in under a year, which tells you how fast the pain arrived.

Every one of those products is a general IT play. Not one of them has any idea what a credential is, what a portal is, what a destination dispatch call is, or why a person’s floor authorization should follow the same rules as their door authorization.

What MCP in physical security looks like when it arrives

It arrives the way every integration wave in this industry has arrived. One per vendor.

Your access control platform ships an MCP server. Your video system ships one. Visitor management, the elevator group, the HR system of record, the badge printer, the locker vendor. Each with its own authentication, its own scopes, its own release cycle, and, critically, its own idea of what a person is. One calls it a cardholder. One calls it a person record. One calls it an employee, one a tenant contact, one a visitor with a sponsor. One models access as a group, one as a schedule, one as a floor list.

An agent connected to six of those is not integrated. It is holding six opinions and no way to reconcile them. Ask it whether a departing contractor still has access and it will answer confidently, from whichever system it happened to consult.

We know how this goes, because we are still living in version one

HID and the FIDO Alliance surveyed 500 security professionals this year. The results should be uncomfortable reading for anyone about to add another integration layer:

• 59% of enterprises manage three or more distinct credential or authentication systems.
• 95% say they can revoke all physical and logical access within 24 hours of a departure. 35% have actually experienced delays or failures doing precisely that.
• 22% report unauthorized access through orphaned or unrevoked credentials.
• Only half have unified reporting ownership across physical and digital identity.

We have not solved the identity silo at the credential layer. The proposal on the table is to build an agent layer on top of that same unresolved disagreement, and then let it open doors.

Five questions worth asking before you connect anything

These are the ones we cannot get a confident answer to from anyone, ourselves included, which is exactly why they are worth asking now rather than in 2028.

1. How many MCP connections does your estate have today, and who keeps that list?
2. What can each one actually reach, as opposed to what its documentation says it reaches?
3. Who authorized it, and are they still with the company?
4. What identity is the agent acting as at the moment it unlocks something?
5. When a person is terminated, what specifically severs the agent’s ability to act on their behalf?

The wider market is not answering these either. A February 2026 survey of more than 900 executives and practitioners found that only 21.9% of organizations treat AI agents as independent, identity-bearing entities, while 88% confirmed or suspected an agent-related security incident in the previous year. Separately, a Vanson Bourne survey of 2,600 decision-makers put the ratio of machine identities to human identities at 82 to 1, and that was before agents started calling tools on their own.

The failure modes are documented, not theoretical. Researchers have demonstrated indirect prompt injection through a connected tool causing an agent to leak private data, and a remote code execution flaw in MCP developer tooling triggered by nothing more than visiting a web page. Neither required an attacker to touch the underlying system directly.

What we want to talk about at GSX 2026

braXos is not exhibiting this year, and we are not bringing a demo. Tom Skoulis and Nick Venuti will be walking the floor on Monday September 14 and most of Tuesday the 15th, and the reason we are going is to have this conversation with the people who will actually have to build it.

Here is the proposition. We think this gets decided over the next eighteen months, mostly by whoever ships first. We would rather sit down with our technology partners now and agree on what a person, a credential, a door and a floor mean, before either side hardcodes an answer the other has to work around for a decade.

That is not a new arrangement, it is the one we already have. When a partner’s platform needs to stay in step with an elevator bank, an HR system of record, a visitor log or forty other things in an enterprise, we build that layer with them rather than at them. An MCP gateway is the same job with a new interface on the front of it, and the same reason to do it together: neither of us owns the whole estate, and the customer owns all of it.

So we want your read rather than our own. Are your customers asking about agents yet, or is it still a slide? Is anyone asking you to build an MCP server, and who? Is any of this producing revenue, or is it the most expensive conversation in your pipeline? We have opinions, but we would rather leave Atlanta with better data than we arrived with.

More on the platform in the braXos connector library, or read about GSX 2026 on the ASIS International site.

Visit us at www.braXos.com | [email protected]