Golf - MCP Agent Security

Y Combinator-backed control plane for agentic AI: discover, govern, and audit every AI agent and MCP connection in an org — without controlling the LLM or changing how anyone works. Also ships GolfMCP, an open-source framework for building production MCP servers. Source: golf.dev, https://golf.dev, 2026-06-13 Source: Y Combinator, https://www.ycombinator.com/companies/golf, 2026-06-13

The problem ("the blind spot")

Shadow AI infrastructure: an engineer connects Cursor to the codebase via MCP in 30 seconds (reading customer records and deal pipelines, and able to update or export them), Claude Code queries the production database, and Copilot pushes to repos while following hidden instructions injected into tool responses — all without security review. MCP connects to data with no LLM-level control and no visibility. Regulatory pressure (FINRA, EU AI Act, SOC 2, HIPAA) demands governance. Source: golf.dev, https://golf.dev, 2026-06-13

Three capabilities

1. Discover — inventory every AI agent, MCP server, and data connection, including ones you didn't know existed.
2. Enforce — granular IAM policies per tool, team, and data source; block PII exposure, credential leaks, and unauthorized access in real time at sub-millisecond latency, with instant rollback.
3. Audit — full activity logs with SIEM and IDP integration.

Source: golf.dev, https://golf.dev, 2026-06-13

Key design decision: the MCP layer, not the model layer

Golf governs at the MCP protocol layer, so policy applies regardless of which LLM powers the agent — Cursor with Claude, Copilot with GPT, and custom agents on open-source models all route through the same enforcement. Source: golf.dev, https://golf.dev, 2026-06-13

GolfMCP (open-source framework)

Separate from the enterprise control plane, golf-mcp/golf (~829 stars) is a file-based framework for building production MCP servers: write the tools, prompts, and resources, and Golf handles routing, auth, observability, telemetry, a debugger, and the runtime. golf deploy yields a live server in under 60 seconds via the hosted Golf Gateway, with real-time traces and error monitoring. The team built it after finding teams spend 2–4 weeks on plumbing (auth, transports, tracing) the MCP spec doesn't cover. Source: GitHub, https://github.com/golf-mcp/golf, 2026-06-13 Source: Y Combinator, https://www.ycombinator.com/companies/golf, 2026-06-13

Complementary: Brin

Golf controls which tools agents can use. Brin - Agent Context Security scores what those tools return — pre-scanning packages, repos, web pages, and MCP servers for malware, prompt injection, and supply chain attacks before the agent acts. Golf is organizational governance; Brin is per-artifact trust scoring.

The discovery layer it governs over

The MCP ecosystem Golf inventories now has a public discovery layer that makes shadow infrastructure easy to spin up: the official MCP Registry (open catalog and API, in preview since September 2025) and the Smithery marketplace (distribution plus an OAuth-aware gateway). The easier it is to wire a new server into Cursor or Claude Code, the more valuable Golf's discover-enforce-audit loop becomes. Source: MCP Blog, https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/, 2025-09-08

Stack fit (Kevin)

• Direct match to Kevin's threat model — the blind-spot scenarios (Cursor reading a codebase, Claude Code on prod, Copilot following injected instructions) are exactly the agents Kevin runs daily; Golf is the org-level counterpart to his per-artifact Brin - Agent Context Security install hook.
• Relevant to Dedalus / Agent Machines — when customer-facing agents connect to data via MCP, a discover/enforce/audit control plane is the governance story enterprise buyers ask for.
• GolfMCP for shipping servers — when building an MCP server for the wiki or a product, GolfMCP's auth + telemetry + runtime removes the 2–4 week plumbing tax; evaluate it against a hand-rolled server.
• Layer it, don't replace Brin — Golf = which tools (protocol governance); Brin = what they return (content trust); the skill-auditor 6-step vet = supply chain. Three different attack classes.

---

Timeline

• 2026-06-13 | Quality remediation: confirmed Golf is YC-backed; added the golf.dev "blind spot" framing, sub-ms enforcement with PII/credential blocking and rollback, SIEM/IDP audit, and the separate open-source GolfMCP server framework (golf-mcp/golf, ~829 stars). Source: https://golf.dev