EMA Impact brief: Why Devolutions’ RDM MCP Server sets a new standard for secure AI automation

AI-powered automation is quickly becoming essential in modern IT operations — but most solutions still violate basic zero-trust principles by exposing credentials to the model. That single architectural flaw has kept many IT leaders from fully embracing AI in privileged workflows.

A new EMA Impact Brief details how Devolutions’ Model Context Protocol (MCP) server for Remote Desktop Manager (RDM) avoids that vulnerability entirely, offering a secure and least-privilege-aligned automation layer designed for real-world IT environments.

Chris Steffen, VP of research at Enterprise Management Associates, summarizes the shift clearly:

Devolutions’ RDM MCP server marks a major market advancement. Its AI integration drives efficiency for IT teams while strengthening security. By embedding robust safeguards directly into the solution, Devolutions sets a new standard for secure, intelligent innovation.

Practical gains for IT teams

The MCP server integrates natural-language automation directly into RDM, allowing administrators to accelerate work without sacrificing control. EMA highlights several concrete benefits:

• Faster task execution: Bulk operations, environment setup, and session launches complete significantly faster.
• Reduced manual errors: Automated steps improve consistency and reliability.
• Centralized workflows: RDM becomes a single execution point for secure AI assistance.
• LLM flexibility: Organizations can choose models that align with internal governance and compliance policies.

These improvements streamline operations while keeping IT in the approval loop.

The security breakthrough: no credential exposure

What truly sets the MCP server apart is its security architecture, specifically how it eliminates the credential-handling flaw seen in most AI automation tools.

EMA calls out several key differentiators:

• Credentials never reach the AI.
  RDM injects them directly into remote sessions, preventing the model from ever seeing or processing them.
• A safer, user-scoped transport mechanism.
  Named pipes bridged through stdio avoid the risks associated with localhost HTTP endpoints.
• Mandatory authorization for every AI action.
  The MCP Connection Prompt serves as a built-in layer of Mandatory Access Control.
• Execution occurs inside the remote session.
  Using an RDP virtual channel, the Devolutions Agent runs commands within the target environment — maintaining MFA and governance boundaries.

This aligns AI automation with the principles of zero trust, least privileges, and privileged access management.

Conclusion

The EMA Impact Brief makes the case clearly: Devolutions’ MCP server isn’t just another AI feature. It’s a secure, technically sound way to bring automation into privileged workflows without opening new attack surfaces.

Read the full EMA Impact Brief to explore the findings and recommendations.