Rubrik launches Code Guardian and an MCP server for agents

On 16 September, TNGlobal reported that Rubrik has launched Code Guardian and an MCP server for AI agents (TNGlobal). Rubrik does not sell models or developer tools: its business is backup, disaster recovery and data security for large organisations. The fact that a company of that profile is packaging part of its product surface as an MCP server says a lot about where the protocol stands almost two years after its release.

Anthropic released Model Context Protocol in November 2024 with a simple idea: let a model call external tools without every vendor inventing its own integration. Through 2025 it was mostly adopted by development tooling, which was the natural ground. What Rubrik's move shows is the next phase, the one where infrastructure software that has been sitting in the data centre for years now wants to be callable by an agent.

What happened

These are two announcements in a single move. The name Code Guardian points at the integrity of the code agents produce, a front that has stopped being hypothetical: teams working with Claude Code or equivalent tools generate volumes of code that no human reviewer audits line by line. The MCP server is the other half of the play: the route through which an agent queries and operates on what Rubrik holds. The exact scope and availability are worth reading in the original TNGlobal piece linked above.

Why it matters

Until now, connecting an agent to an enterprise system meant writing a wrapper over its API, maintaining it and trusting that the vendor would not change the contract. With an official MCP server that work is done by the vendor and any compatible client consumes it: Claude Code, Claude Desktop or your own agent. Integration cost drops sharply, and with it drops the barrier for someone to connect an agent to a sensitive system on a Friday afternoon.

That is the uncomfortable part. An agent with access to the backup catalogue potentially has access to the organisation's full history: databases, files, snapshots of machines somebody believed had been deleted. MCP is not a security problem in itself, but it turns into a tool call what previously required credentials, a VPN and a person with context.

Who it is useful for

1. Platform teams that already run Rubrik and want to ask about backup status without opening the console.
2. Security teams, who should treat the MCP server as a new surface rather than one more integration in the catalogue.
3. Anyone building internal agents: the pattern (established product plus official MCP server) is going to repeat, and it is worth watching how a vendor with regulated customers solves it.

What we would check before plugging it in

At ElephantPink we build MCP servers for clients and the checklist is always the same:

1. Which tools it exposes and which ones write. A read only MCP is a design decision, not a shortcoming.
2. How it authenticates and where the credentials live. An admin scoped token inside a config file is the most repeated failure we see.
3. Whether calls leave a trail. If an agent restores a snapshot, the record must show who asked for it and with what instruction.
4. What hooks sit in front. In Claude Code, a PreToolUse hook is still the cheap way to stop destructive tools before they run.

Rubrik's announcement does not change how agents are built, but it confirms that MCP now works as the default connector for enterprise software rather than a community experiment. We care more about the consequence than the headline: once the protocol reaches the systems where the real data lives, the question stops being what an agent can do and becomes what it should be allowed to do.