Project · Active · started
Securing Agent Tool Use: An MCP Control Catalogue
A vendor-neutral catalogue of controls for agents that call tools through the Model Context Protocol. It covers tool poisoning, confused-deputy access, weak server authentication and over-privileged credentials, organised by where each control sits in the life of a tool call.
Scope
The moment an agent can call tools, a prompt injection stops being a bad answer and becomes an action taken with someone’s credentials. MCP made connecting tools easy; it did not make it safe by default. This project collects the controls that matter and places each one at the point in a tool call where it actually works:
- Discovery: which servers and tools an agent is allowed to see, and how tool descriptions are reviewed and pinned.
- Authentication and authorisation: whose authority the tool acts with, and how to avoid the confused deputy.
- Execution: sandboxing, egress limits, approval for high-impact actions.
- Audit: the evidence you need to reconstruct what an agent did and why.
Status
Scoping. Collecting real-world MCP failure modes and mapping them to controls.
Planned artifacts
- Control checklist across the tool-call lifecycle
- Approval-policy template for high-impact tool actions
- Review questions for adopting a third-party MCP server