Picture a Monday meeting. Your security lead asks a simple question: which MCP servers are the agents in our company actually talking to? You know people run agents on their laptops, some of them personal devices. You know those agents reach sensitive data through tokens, service accounts or OAuth integrations. What you don't have is a list.
That is the gap Token Security describes in a post about Anthropic's new Compliance API. Token Security is a non-human identity security company, and the post is titled "Why Anthropic's new Compliance API is a Game-Changer for Secure Agentic AI Access." Its argument is that monitoring has focused on cloud services, identity providers and SaaS, while agents run on endpoints. In its words, "This is an AI agent visibility problem."
The post says Anthropic's Compliance API "narrows that gap" by providing "usage, access, and security data from Claude clients." It quotes Anthropic's own description: compliance teams "get real-time programmatic access to Claude usage data and customer content," and can "manage data retention through selective deletion capabilities." For you, the detail worth stopping on is that the telemetry includes "which Model Context Protocol (MCP) servers are in use." That is close to the exact question from your Monday meeting.
The post also describes a change in how you would work. Instead of "periodic audits or manual exports," you would monitor continuously. Token Security is open about its own interest here: "Only NHI vendors have the context across the entire technology stack to properly understand and quantify risk." It names an existing OpenAI integration and says Cursor is next.
Read it with that in mind. The APIs.io write-up is plain about what this is: a partner announcement, and it reads like one. There are no figures in it. Token Security is making a case for an API it did not build. What you can take from it is the substance: an AI platform now exposes agent activity, including MCP usage, through an API that a security tool can consume.
Then the post turns to the company itself, and this is the part to keep in mind before you rely on any vendor's story. The APIs.io catalog holds Token Security with almost nothing to read. The Token provider page lists no API pages. The one lit Agent Readiness dimension is the MCP server. Spec presence, auth clarity and agentic access are unlit, so the catalog has found no published description of the platform that would consume this telemetry. The Kin Score is 18.7, in the emerging band, with discoverability at 48.3 and access clarity at 36.8, against contract quality at 0.0. The Agent Readiness score is 3.5, human-only.
So the company explaining how security teams will find out what their agents touch has not yet described, in public, the API you would use to ask. That is a limit worth weighing if you are deciding whether to build on it.
The post makes one more point that reaches well beyond Token Security. An inventory of which MCP servers an organization's agents use is the demand side of everything this series measures on the supply side. Every unlit MCP server dimension the catalog has recorded this month, for AWS, Kong, Atlassian and Apigee, is a server your agents may be using that a public record cannot yet see.
Here is what you take back to that Monday meeting. First, the visibility gap is real enough that an AI platform is now exposing MCP usage through an API. Second, the claim that only NHI vendors can quantify the risk comes from an NHI vendor, so treat it as an argument and not a finding. Third, your inventory will only be as good as the public record behind the servers on it, and for several large providers that record still has blanks. Ask for the list, and expect some entries you can't yet verify.
Read the original: https://apis.io/2026/10/26/token-security-says-anthropics-compliance-api-closes-the-endpoint-blind-spot/