Agentic AI Security: MCP Servers, Incident Response, and Forensic Readiness

Decision Question

How should organizations design, operate, investigate and recover agentic AI systems that use MCP servers without mistaking model instructions for enforceable security controls?

Field: Decision Question Value: How should organizations design, operate, investigate and recover agentic AI systems that use MCP servers without mistaking model instructions for enforceable security controls?

Interpreted Questions

Which agent, MCP server, tool, identity, credential, memory, data, and downstream-system trust boundaries require deterministic controls? What evidence must responders preserve, and how should teams contain and recover an unsafe workflow?

Field: Interpreted Questions Value: Which agent, MCP server, tool, identity, credential, memory, data, and downstream-system trust boundaries require deterministic controls? What evidence must responders preserve, and how should teams contain and recover an unsafe workflow?

Initial Observations

The retained sources consistently separate model behavior from enforceable security controls: operational risk emerges when untrusted influence is combined with real tool authority, privileged identities, sensitive data, or write-capable downstream systems.

Field: Initial Observations Value: The retained sources consistently separate model behavior from enforceable security controls: operational risk emerges when untrusted influence is combined with real tool authority, privileged identities, sensitive data, or write-capable downstream systems.

Primary Starting Point

The user-supplied 28-page CrowdStrike ebook provides the primary architecture, failure-mode, hardening and 90-day roadmap structure. PANDA independently reconciles its recommendations against protocol, framework, platform, investigation and vulnerability sources.

Field: Primary Starting Point Value: The user-supplied 28-page CrowdStrike ebook provides the primary architecture, failure-mode, hardening and 90-day roadmap structure. PANDA independently reconciles its recommendations against protocol, framework, platform, investigation and vulnerability sources.^[1]

In Scope

Agent inputs, system instructions, planning, memory, MCP client/server discovery and invocation, tool metadata, authorization, credentials, downstream systems, observability, incident response, evidence collection, containment and recovery.

Field: In Scope Value: Agent inputs, system instructions, planning, memory, MCP client/server discovery and invocation, tool metadata, authorization, credentials, downstream systems, observability, incident response, evidence collection, containment and recovery.

Fact / Analysis / Unknown Boundaries

This is not a finding that every agent or MCP server is compromised. Product-specific controls are examples, not universal telemetry. The brief does not equate every model error with malicious activity and does not require private chain-of-thought collection.

Field: Fact / Analysis / Unknown Boundaries Value: This is not a finding that every agent or MCP server is compromised. Product-specific controls are examples, not universal telemetry. The brief does not equate every model error with malicious activity and does not require private chain-of-thought collection.

Source Coverage

Field: Source Coverage

Tier 0 - Protocol, government, framework, and vulnerability records

6

Field: Tier 0 - Protocol, government, framework, and vulnerability records Value: 6 6 6 0

Tier 1 - Primary guide and platform security sources

6

Field: Tier 1 - Primary guide and platform security sources Value: 6 6 6 0

Tier 2 - Emerging control research

1

Field: Tier 2 - Emerging control research Value: 1 1 1 0

Tier 3 - Corroborating journalism

0

Field: Tier 3 - Corroborating journalism Value: 0 0 0 0

Tier 4 - Community signal

0

Field: Tier 4 - Community signal Value: 0 0 0 0

Tier 5 - User-supplied source

1

Field: Tier 5 - User-supplied source Value: 1 1 1 0

Tier 6 - API / private integration

0

Field: Tier 6 - API / private integration Value: 0 0 0 0

Tier 7 - Inner discovery / carved URLs

0

Field: Tier 7 - Inner discovery / carved URLs Value: 0 0 0 0

Tier 8 - Expansion research not promoted to the retained set

0

Field: Tier 8 - Expansion research not promoted to the retained set Value: 0 0 0 0

Total distinct retained sources

14

Field: Total distinct retained sources Value: 14 14 14 0

Agent

An LLM becomes operationally consequential when it can select tools, retrieve data, update memory, repeat actions and act under a real identity.

Dimension: Agent What Readers Should Know: An LLM becomes operationally consequential when it can select tools, retrieve data, update memory, repeat actions and act under a real identity. Operational Test: Can the system access or change something outside the chat response?

MCP

MCP standardizes capability discovery and invocation; it does not remove the need for server trust, authorization, least privilege, policy enforcement and audit.

Dimension: MCP What Readers Should Know: MCP standardizes capability discovery and invocation; it does not remove the need for server trust, authorization, least privilege, policy enforcement and audit. Operational Test: Can every active server, tool, origin, version, identity and downstream permission be named?

Primary risk

Untrusted content or metadata can influence a model, but impact occurs when the agent's authority and tools convert that influence into action.

Dimension: Primary risk What Readers Should Know: Untrusted content or metadata can influence a model, but impact occurs when the agent's authority and tools convert that influence into action. Operational Test: What deterministic control stands between model output and tool execution?

Incident response

Response must preserve the full request-to-action chain, not only the final answer or endpoint process.

Dimension: Incident response What Readers Should Know: Response must preserve the full request-to-action chain, not only the final answer or endpoint process. Operational Test: Can investigators link user, content, agent, tool, policy, identity, memory and target-system events?

Forensics

The most probative evidence is often split across agent telemetry, MCP manifests and calls, authorization records, endpoint/network evidence and downstream audit logs.

Dimension: Forensics What Readers Should Know: The most probative evidence is often split across agent telemetry, MCP manifests and calls, authorization records, endpoint/network evidence and downstream audit logs. Operational Test: Can the team export those records with common time and correlation fields before retention expires?

Desired outcome

Agents should be bounded, attributable, interruptible, recoverable and testable even when model behavior varies.

Dimension: Desired outcome What Readers Should Know: Agents should be bounded, attributable, interruptible, recoverable and testable even when model behavior varies. Operational Test: Can a compromised or confused agent be stopped without compromising every connected system?

Executives and risk owners

Risk appetite, business impact, accountable ownership and funding.

Audience: Executives and risk owners What They Own: Risk appetite, business impact, accountable ownership and funding. Questions This Brief Answers: Where can agent authority create material loss? Which controls are prerequisites to production? How should incidents be reported?

Security architecture / AppSec / cloud security

Threat model, identity, trust boundaries, secure design, supply chain and pre-execution controls.

Audience: Security architecture / AppSec / cloud security What They Own: Threat model, identity, trust boundaries, secure design, supply chain and pre-execution controls. Questions This Brief Answers: Where does MCP change the trust model? Which controls must be deterministic? How should server and tool drift be governed?

SOC, detection and incident response

Telemetry, detections, triage, containment, evidence and recovery.

Audience: SOC, detection and incident response What They Own: Telemetry, detections, triage, containment, evidence and recovery. Questions This Brief Answers: What should trigger an alert? Which evidence proves impact? How do we pause and recover an agent workflow?

Agent and MCP developers

Client/server implementation, schemas, policies, tests, logging, deployment and rollback.

Audience: Agent and MCP developers What They Own: Client/server implementation, schemas, policies, tests, logging, deployment and rollback. Questions This Brief Answers: How should tools be scoped? What must be logged? What should fail closed? How are versions and changes approved?

AI governance, privacy, legal and compliance

Acceptable use, data handling, approval, retention, incident disclosure and vendor oversight.

Audience: AI governance, privacy, legal and compliance What They Own: Acceptable use, data handling, approval, retention, incident disclosure and vendor oversight. Questions This Brief Answers: What records are necessary? Where can sensitive data move? Which actions require independent human approval?

External content → agent context

Documents, email, web, code, logs, tickets, search and tool results.

Boundary: External content → agent context What Crosses It: Documents, email, web, code, logs, tickets, search and tool results. Required Control: Source provenance, trust label, content isolation, data classification, injection inspection and task-scoped retrieval. Evidence To Retain: Source URI/ID, content hash, retrieved excerpt, classification, fetch time, parser and transformation.

Model intent → action request

Tool selection and generated arguments.

Boundary: Model intent → action request What Crosses It: Tool selection and generated arguments. Required Control: Strict schema, argument policy, file/network/destination checks, data-flow rules, rate limits and approval. Evidence To Retain: Agent/model/config version, session, tool, arguments, policy result, reason code and approval.

MCP client → server

Discovery, JSON-RPC requests, resources, prompts, tool calls and session state.

Boundary: MCP client → server What Crosses It: Discovery, JSON-RPC requests, resources, prompts, tool calls and session state. Required Control: Trusted origin, authentication, authorization, transport protection, version/manifest validation and session isolation. Evidence To Retain: Server identity, URL/command, transport, version, manifest hash, request/response IDs and timestamps.

MCP server → downstream resource

Queries, writes, messages, files, commands, exports and administrative actions.

Boundary: MCP server → downstream resource What Crosses It: Queries, writes, messages, files, commands, exports and administrative actions. Required Control: User/agent-context authorization, minimal scopes, network policy, transaction limits and target-side audit. Evidence To Retain: Caller identity, resource, action, before/after state, result, recipient/destination and target audit ID.

Result → memory / future session

Facts, instructions, summaries, credentials, user data and task state.

Boundary: Result → memory / future session What Crosses It: Facts, instructions, summaries, credentials, user data and task state. Required Control: Provenance, tenant/task isolation, classification, write policy, TTL, review, quarantine and rollback. Evidence To Retain: Writer, source, content/object ID, timestamp, tenant/task, expiration, retrieval history and deletion.

Prompts, email, documents, web pages, tickets, code, tool responses

System prompt, model, planner, context window, memory, task state

Identity, tool allowlist, argument policy, data-flow rules, human approval

Discovery, tool metadata, JSON-RPC calls, resources, prompts, transport

Files, repositories, SaaS, databases, cloud, endpoints, messaging

Prompt and tool events, policy decisions, results, memory writes, target audit logs

The security objective is not to make model reasoning perfectly predictable. It is to keep every transition into action attributable, policy-checked, least-privileged, reversible where possible, and reconstructable after an incident.

Indirect prompt injection

Instructions hidden in email, web pages, documents, code, issues, logs, or tool results are interpreted as part of the agent's task.

Risk / Failure Mode: Indirect prompt injection How It Works: Instructions hidden in email, web pages, documents, code, issues, logs, or tool results are interpreted as part of the agent's task. Likely Impact: Unapproved tool use, data access, data leakage, unsafe code changes, altered conclusions, or poisoned memory. Control Point: Mark external content as untrusted; isolate it; inspect input and tool responses; require deterministic policy before actions.^{[1] [4] [6] [10] [11]}

Tool poisoning

A tool description or schema contains instructions that influence the model to collect or send data the tool does not need.

Risk / Failure Mode: Tool poisoning How It Works: A tool description or schema contains instructions that influence the model to collect or send data the tool does not need. Likely Impact: Secret theft, parameter manipulation, selection of attacker-controlled tools, or silent policy bypass. Control Point: Review and hash tool definitions; reject instructions in metadata; minimize parameters; scan definitions before model exposure.^{[1] [6] [12]}

Tool shadowing / name collision

One tool's description changes how the model calls another tool, or a similarly named tool competes with an approved capability.

Risk / Failure Mode: Tool shadowing / name collision How It Works: One tool's description changes how the model calls another tool, or a similarly named tool competes with an approved capability. Likely Impact: Hidden recipients, changed destinations, unintended write operations, or attacker-preferred execution. Control Point: Namespace tools by trusted origin; prevent duplicate names; expose only task-required tools; evaluate the full active tool set.^{[1] [12]}

Rug pull / capability drift

A previously approved remote server changes code, tool metadata, schemas, or behavior after integration.

Risk / Failure Mode: Rug pull / capability drift How It Works: A previously approved remote server changes code, tool metadata, schemas, or behavior after integration. Likely Impact: A trusted workflow quietly becomes an exfiltration or destructive-action path. Control Point: Pin versions; sign and hash manifests; diff each discovery response; require reapproval for behavioral changes.^{[1] [6] [12]}

Confused deputy / token misuse

Weak consent, redirect validation, audience validation, or token passthrough lets a client or proxy misuse authorization.

Risk / Failure Mode: Confused deputy / token misuse How It Works: Weak consent, redirect validation, audience validation, or token passthrough lets a client or proxy misuse authorization. Likely Impact: Unauthorized downstream access under a legitimate user's or server's identity. Control Point: Use per-client consent, exact redirect matching, PKCE, audience-bound tokens, validated scopes, and separate downstream tokens.^{[2] [3]}

Unauthenticated or overprivileged MCP service

A remote or local HTTP MCP service is exposed without adequate authentication or executes tools under broad service privileges.

Risk / Failure Mode: Unauthenticated or overprivileged MCP service How It Works: A remote or local HTTP MCP service is exposed without adequate authentication or executes tools under broad service privileges. Likely Impact: Direct access to internal tools, repositories, ticketing, HR data, cloud resources, or command execution. Control Point: Authenticate every remote request; run as a constrained identity; restrict network exposure; sandbox local servers.^{[2] [7] [13] [14]}

Memory poisoning / cross-session leakage

Attacker-controlled instructions or sensitive results persist in memory and influence a later user or task.

Risk / Failure Mode: Memory poisoning / cross-session leakage How It Works: Attacker-controlled instructions or sensitive results persist in memory and influence a later user or task. Likely Impact: Persistence, data disclosure, incorrect decisions, or delayed tool abuse. Control Point: Separate tenants and task memory; classify writes; retain provenance; expire memory; support quarantine and rollback.^{[1] [4] [5]}

Excessive agency / cascading execution

Individually allowed calls combine into a harmful sequence, retries amplify impact, or an agent acts without an effective approval boundary.

Risk / Failure Mode: Excessive agency / cascading execution How It Works: Individually allowed calls combine into a harmful sequence, retries amplify impact, or an agent acts without an effective approval boundary. Likely Impact: Bulk modification, service disruption, financial or communications harm, or rapid lateral movement. Control Point: Set budgets, rate limits, circuit breakers, workflow-level policy, approval gates, and safe rollback.^{[1] [4] [12]}

Risk scoring shortcut

Start with four questions: Can the tool read sensitive data? Can it write or delete? Can it send outside the trust zone? Can it change identity, privileges, code or infrastructure? The more “yes” answers, the stronger the required isolation, policy, approval, logging and recovery controls.

1 - Seed

Place instructions in a prompt, document, web page, issue, email, code, log or tool result.

Stage: 1 - Seed Attacker Influence: Place instructions in a prompt, document, web page, issue, email, code, log or tool result. Defender Intercept: Provenance, trust labels, isolation, content inspection and restricted retrieval. Best Evidence: Original content, source, hash, fetch event, user/session and parser output.

2 - Reframe

Cause the model to reinterpret the user's task, add a hidden goal or disregard a constraint.

Stage: 2 - Reframe Attacker Influence: Cause the model to reinterpret the user's task, add a hidden goal or disregard a constraint. Defender Intercept: Explicit task declaration, plan boundaries, context separation and drift detection. Best Evidence: User request, system/config version, task events and content used.

3 - Select

Steer the agent to a poisoned, shadowed or overpowered tool.

Stage: 3 - Select Attacker Influence: Steer the agent to a poisoned, shadowed or overpowered tool. Defender Intercept: Task-specific tool exposure, unique origin-bound names, approved manifests and risk-tier policy. Best Evidence: Active tool list, definitions, origins, hashes, selection and policy record.

4 - Construct

Insert sensitive paths, values, recipients, commands or destinations into tool parameters.

Stage: 4 - Construct Attacker Influence: Insert sensitive paths, values, recipients, commands or destinations into tool parameters. Defender Intercept: Strict schema, allowlists, DLP/secret scanning, path normalization, redaction and human approval. Best Evidence: Pre-tool arguments, policy results, approvals and blocked/allowed decision.

5 - Execute

Use MCP server authority to act on files, APIs, SaaS, code, cloud or messaging.

Stage: 5 - Execute Attacker Influence: Use MCP server authority to act on files, APIs, SaaS, code, cloud or messaging. Defender Intercept: Least-privileged identity, downstream authorization, sandboxing, egress policy and transaction limits. Best Evidence: MCP request/response, identity/token metadata, endpoint/network and target-system audit.

6 - Persist / amplify

Write poisoned memory, schedule follow-on work, retry, fan out or trigger another agent.

Stage: 6 - Persist / amplify Attacker Influence: Write poisoned memory, schedule follow-on work, retry, fan out or trigger another agent. Defender Intercept: Memory provenance, queue controls, circuit breakers, budgets, multi-agent trust and kill switches. Best Evidence: Memory/queue changes, subsequent sessions, agent-to-agent messages and execution graph.

7 - Conceal / normalize

Return plausible output while the hidden action succeeds.

Stage: 7 - Conceal / normalize Attacker Influence: Return plausible output while the hidden action succeeds. Defender Intercept: Independent target audit, reconciliation of proposed versus completed actions and anomaly detection. Best Evidence: Downstream before/after state, external recipient/destination, data-access and change records.

Summarize a public repository

A normal summary task.

Scenario: Summarize a public repository What The Reader Sees: A normal summary task. What Actually Goes Wrong: A README or issue instructs the agent to read a local secret and include it in a tool call. Prevent / Detect: Treat repository content as untrusted; block secrets in tool payloads; restrict local file reads; correlate read→external call.

Send a metrics report

A legitimate email tool sends expected content.

Scenario: Send a metrics report What The Reader Sees: A legitimate email tool sends expected content. What Actually Goes Wrong: Another tool's description influences the model to add a hidden BCC recipient. Prevent / Detect: Expose only required tools; approve recipients; validate destinations independently of model output.

Fetch internal data

The tool returns correct results.

Scenario: Fetch internal data What The Reader Sees: The tool returns correct results. What Actually Goes Wrong: A remote server changed after review and now forwards the data before returning it. Prevent / Detect: Pin and attest server behavior; monitor egress; diff manifests and implementation; audit target and network paths.

Connect a SaaS account

A familiar consent flow.

Scenario: Connect a SaaS account What The Reader Sees: A familiar consent flow. What Actually Goes Wrong: Weak per-client consent or redirect binding lets a malicious client obtain authorization under the user's account. Prevent / Detect: Per-client consent, exact redirect matching, PKCE, audience binding, client registry and consent audit.

Install a local MCP helper

A one-click configuration entry.

Scenario: Install a local MCP helper What The Reader Sees: A one-click configuration entry. What Actually Goes Wrong: The host executes an opaque command with user privileges and broad file/network access. Prevent / Detect: Display full command; require explicit consent; sandbox; restrict directories/network; inventory process and package provenance.

Remember a project preference

The assistant becomes more helpful later.

Scenario: Remember a project preference What The Reader Sees: The assistant becomes more helpful later. What Actually Goes Wrong: Instruction-like content persists and steers future tasks or leaks another user's data. Prevent / Detect: Task/tenant isolation, provenance, TTL, classified writes, retrieval audit, quarantine and reset.

Now

Block production use of unknown, unauthenticated or ownerless MCP servers and write-capable tools.

Priority: Now Action: Block production use of unknown, unauthenticated or ownerless MCP servers and write-capable tools. Accountable Owner: CISO / Platform Engineering Decision / Proof: Approved server registry; enforced allowlist; exposure scan; exception owner and expiry.

Now

Inventory which agents can read secrets, send externally, modify code/data, administer systems or write durable memory.

Priority: Now Action: Inventory which agents can read secrets, send externally, modify code/data, administer systems or write durable memory. Accountable Owner: Security Architecture / Engineering Decision / Proof: Capability matrix linked to agent, identity, scopes, downstream resources and kill switch.

30 days

Insert deterministic policy before every medium/high-risk tool call.

Priority: 30 days Action: Insert deterministic policy before every medium/high-risk tool call. Accountable Owner: Agent Platform / AppSec Decision / Proof: Allow/deny/approve rules tested against adversarial parameters and sequence abuse.

30 days

Implement version, origin and tool-definition drift detection.

Priority: 30 days Action: Implement version, origin and tool-definition drift detection. Accountable Owner: Supply Chain Security / Platform Decision / Proof: Last-known-good hashes; signed change workflow; alert and rollback test.

45 days

Correlate agent, MCP, identity, network and downstream audit telemetry.

Priority: 45 days Action: Correlate agent, MCP, identity, network and downstream audit telemetry. Accountable Owner: SOC / Detection Engineering Decision / Proof: One end-to-end test action reconstructed from request through target outcome.

60 days

Create unique, short-lived and task-scoped identities for agents and servers.

Priority: 60 days Action: Create unique, short-lived and task-scoped identities for agents and servers. Accountable Owner: IAM / Cloud Security Decision / Proof: No shared broad service account; scopes and audiences verified; emergency revocation tested.

75 days

Create non-bypassable human approval for destructive, external, privileged and high-value actions.

Priority: 75 days Action: Create non-bypassable human approval for destructive, external, privileged and high-value actions. Accountable Owner: Business Owner / Engineering / GRC Decision / Proof: Independent approval UI and immutable record; agent cannot alter or self-approve.

90 days

Run an agent-specific incident tabletop and technical recovery exercise.

Priority: 90 days Action: Run an agent-specific incident tabletop and technical recovery exercise. Accountable Owner: IR / Platform / Legal / Business Decision / Proof: Evidence captured, server isolated, credentials revoked, memory preserved, canary recovery completed.

Weeks 1-2

Inventory and classify

Window: Weeks 1-2 Workstream: Inventory and classify Deliverables: Agent, MCP server and tool inventory; owner; transport; identity; data access; side effects; write/delete/external/network risk tier. Acceptance Test: Every production agent resolves to an owner, active tool set, server origin, credential, downstream systems and kill switch.

Weeks 2-4

Authentication and version control

Window: Weeks 2-4 Workstream: Authentication and version control Deliverables: Remote authorization, audience validation, short-lived tokens, exact redirect rules, per-client consent, version pinning, manifest hashes, change approval. Acceptance Test: Unknown server, unsigned definition, wrong-audience token and unapproved update are rejected.

Weeks 3-6

Input and pre-execution guardrails

Window: Weeks 3-6 Workstream: Input and pre-execution guardrails Deliverables: Untrusted-content labeling, response inspection, strict schemas, path and destination allowlists, redaction, payload limits, sandboxing, policy-as-code. Acceptance Test: Adversarial content cannot cause a secret read, external send, privileged write or out-of-scope path without a deterministic block or approval.

Weeks 4-8

Observability and detection

Window: Weeks 4-8 Workstream: Observability and detection Deliverables: Correlated prompt, tool, policy, identity, memory and target-system telemetry; baselines; SIEM rules; evidence export; retention. Acceptance Test: Investigators reconstruct one complete agent action from user/request through downstream effect using shared IDs and normalized clocks.

Weeks 6-10

Govern capability drift

Window: Weeks 6-10 Workstream: Govern capability drift Deliverables: Definition diffs, server/tool approval, owner RACI, deprecation workflow, dependency scanning, signed change record, shadow-tool detection. Acceptance Test: A changed description, schema, origin or implementation cannot enter production silently.

Weeks 8-12

Non-human identity controls

Window: Weeks 8-12 Workstream: Non-human identity controls Deliverables: Unique agent identities, minimal task scopes, just-in-time access, credential rotation, read/write separation, privilege-use monitoring. Acceptance Test: Compromise of one agent credential cannot access unrelated data, tenants, tools or production administration.

Weeks 10-12

Human approval for high-impact actions

Window: Weeks 10-12 Workstream: Human approval for high-impact actions Deliverables: Action taxonomy, non-bypassable approval service, independent approval display, immutable record, SLA and escalation path. Acceptance Test: The agent cannot alter the approval request, approve itself, or execute before approval.

Weeks 8-12

Incident readiness

Window: Weeks 8-12 Workstream: Incident readiness Deliverables: Severity matrix, playbook, forensics checklist, kill-switch test, evidence-retention validation, cross-functional tabletop. Acceptance Test: A tabletop team can pause the agent, revoke identities, preserve evidence, scope downstream effects and recover through a canary workflow.

How to use the roadmap

The windows overlap. Start with the smallest production agent that has meaningful access, prove the controls and investigation trail there, then reuse the pattern. A completed policy document is not an acceptance test; a blocked call, reconstructed timeline, revoked identity and canary recovery are.

0 - Prepare

Know what exists and make response possible before the first alert.

Phase: 0 - Prepare Objective: Know what exists and make response possible before the first alert. Actions: Inventory agents, owners, models, MCP clients/servers, tools, identities, secrets, data stores, memory, transports, downstream systems, approval gates, logs, retention, and emergency kill switches. Pre-stage evidence export and token-revocation procedures. Exit / Evidence: Current architecture map; named incident owner; tested log access; server isolation method; agent pause method; credential inventory; tabletop completed.^{[1] [5] [8] [9]}

1 - Declare and triage

Decide whether this is blocked probing, agent misbehavior, credential exposure, unauthorized action, or confirmed impact.

Phase: 1 - Declare and triage Objective: Decide whether this is blocked probing, agent misbehavior, credential exposure, unauthorized action, or confirmed impact. Actions: Open a case; record first observed time; identify user, device, agent, session, model, server and tool; preserve the triggering content and current tool manifest; assign severity; avoid restarting components before volatile state is captured. Exit / Evidence: Case number; incident clock; initial severity; known affected agent/session; first evidence package; preservation owner.^{[1] [8] [10]}

2 - Contain

Stop further decisions and actions without erasing the record.

Phase: 2 - Contain Objective: Stop further decisions and actions without erasing the record. Actions: Pause agent jobs and queues; disable write-capable tools; quarantine the suspect MCP server; block suspicious destinations; revoke affected agent/server OAuth grants and credentials; freeze implicated memory; preserve snapshots before changing configuration. Exit / Evidence: No new suspect tool calls; affected identities revoked; server isolated; queues preserved; memory snapshot recorded; downstream owners notified.^{[1] [2] [3]}

3 - Scope and investigate

Reconstruct how intent became action and determine blast radius.

Phase: 3 - Scope and investigate Objective: Reconstruct how intent became action and determine blast radius. Actions: Build a timeline from user prompt and retrieved content through planner state, tool discovery, policy decision, parameters, MCP response, memory writes and downstream actions. Identify all resources touched, secrets exposed, recipients, code changes, queries, files, and follow-on sessions. Exit / Evidence: Correlated event timeline; affected data/system list; credential exposure list; impacted users/tenants; confirmed and unconfirmed actions separated.^{[1] [8] [9] [10]}

4 - Eradicate

Remove the manipulation path and repair compromised trust.

Phase: 4 - Eradicate Objective: Remove the manipulation path and repair compromised trust. Actions: Remove poisoned content and metadata; restore approved manifests; patch clients, servers and SDKs; eliminate shadow tools; cleanse or quarantine memory; rotate credentials; repair downstream changes; revoke unapproved registrations and sessions. Exit / Evidence: Known root cause removed; patched versions verified; clean configuration hashes; new credentials issued; malicious persistence and memory artifacts removed.^{[1] [2] [6] [13] [14]}

5 - Recover

Return capability gradually and prove the workflow is bounded.

Phase: 5 - Recover Objective: Return capability gradually and prove the workflow is bounded. Actions: Start with a canary agent using no production secrets; expose read-only tools first; replay benign and adversarial tests; validate policy and approval gates; restore write tools in stages; watch tool sequences and downstream audit logs. Exit / Evidence: Acceptance tests passed; read/write scopes verified; no unexpected egress; approvals visible; enhanced monitoring active; business owner accepts residual risk.^{[1] [4] [5] [10] [12]}

6 - Lessons and disclosure

Convert the incident into durable controls and meet notification obligations.

Phase: 6 - Lessons and disclosure Objective: Convert the incident into durable controls and meet notification obligations. Actions: Document root cause, missed signals, telemetry gaps, control failures, data affected, legal/privacy obligations, vendor coordination, detection updates, and architecture changes. Preserve evidence and publish a tested corrective-action plan. Exit / Evidence: Approved after-action report; tracked remediation; updated detections; disclosure decision; revised tabletop; owners and dates assigned.^{[5] [8]}

Suggested severity ladder

SEV 1: Confirmed unauthorized privileged/destructive action, sensitive-data exfiltration, credential compromise, cross-tenant access or active persistence.

SEV 2: Suspicious tool execution, unapproved server, token misuse or memory poisoning with plausible impact not yet confirmed.

SEV 3: Injection, tool poisoning or drift detected and blocked before action; no target-system effect found.

SEV 4: Inventory, logging, versioning or policy hygiene gap without observed misuse.

First 30 minutes

Open the incident clock and name the affected agent/session.

Pause new work and preserve in-flight state, active definitions and queues.

Disable write tools and isolate the suspect server or destination.

Capture identity, token metadata, content, tool call and downstream evidence.

Revoke affected grants/credentials and notify downstream system owners.

Separate blocked, attempted and completed actions before declaring impact.

1 - Volatile execution state

Running agent and MCP processes, child processes, command lines, environment variable names, loaded configuration paths, current sockets, in-flight requests, queues, active sessions, and current memory/task state.

Priority: 1 - Volatile execution state Collect / Preserve: Running agent and MCP processes, child processes, command lines, environment variable names, loaded configuration paths, current sockets, in-flight requests, queues, active sessions, and current memory/task state. Key Questions: What was executing when the alert fired? Which process had the credential and network reach? Were actions pending? Handling Notes: Snapshot before restart or containment when safe. Do not copy raw secrets into the case narrative; preserve them in restricted evidence storage.

2 - Agent and MCP configuration

Agent manifest, system prompt version, model and runtime version, MCP client configuration, server command/URL, transport, tool list, descriptions, schemas, prompts/resources, package versions, hashes, signatures, owners, and approval record.

Priority: 2 - Agent and MCP configuration Collect / Preserve: Agent manifest, system prompt version, model and runtime version, MCP client configuration, server command/URL, transport, tool list, descriptions, schemas, prompts/resources, package versions, hashes, signatures, owners, and approval record. Key Questions: What capabilities did the model see? Did a tool definition, origin, schema or server version change after approval? Handling Notes: Export both current and last-known-good versions. Hash each artifact and retain the discovery response, not only the source repository.

3 - Agent-loop telemetry

User prompt, retrieved external content, model output needed for the case, plan/task events if retained, pre-tool request, tool name, arguments, policy result, approval, post-tool result, errors, retries, token counts, session and correlation IDs.

Priority: 3 - Agent-loop telemetry Collect / Preserve: User prompt, retrieved external content, model output needed for the case, plan/task events if retained, pre-tool request, tool name, arguments, policy result, approval, post-tool result, errors, retries, token counts, session and correlation IDs. Key Questions: Which content introduced the instruction? Why was this tool eligible? What exact arguments crossed the action boundary? Handling Notes: Minimize sensitive content while preserving decisive evidence. Record logging gaps explicitly; do not invent a chain-of-thought record that the platform never captured.

4 - Identity and authorization

User, device, agent and workload identities; OAuth client/server metadata; issuer, audience, scopes, consent, token issue/revocation times, authentication events, session IDs, service-account use, authorization failures, and secret-manager access.

Priority: 4 - Identity and authorization Collect / Preserve: User, device, agent and workload identities; OAuth client/server metadata; issuer, audience, scopes, consent, token issue/revocation times, authentication events, session IDs, service-account use, authorization failures, and secret-manager access. Key Questions: Whose authority was used? Was the token intended for this server? Did the server pass a token downstream or execute under a broader identity? Handling Notes: Retain token metadata and hashes where possible, not usable bearer tokens. Coordinate revocation with evidence preservation.

5 - Downstream actions and data

Repository commits and API logs, file-system events, database queries, cloud activity, SaaS audit events, messages/email recipients, ticket changes, exports, object access, DLP alerts, and target-system before/after state.

Priority: 5 - Downstream actions and data Collect / Preserve: Repository commits and API logs, file-system events, database queries, cloud activity, SaaS audit events, messages/email recipients, ticket changes, exports, object access, DLP alerts, and target-system before/after state. Key Questions: What actually changed or left the environment? Which action was merely proposed, blocked, attempted, or completed? Handling Notes: The downstream system is often the best proof of impact. Preserve native audit exports with source timestamps and correlation IDs.

6 - Memory, context and retrieval

Conversation state, memory records, vector-store document IDs and metadata, retrieval results, provenance, tenant/task boundaries, write history, TTL/expiration, and deletions.

Priority: 6 - Memory, context and retrieval Collect / Preserve: Conversation state, memory records, vector-store document IDs and metadata, retrieval results, provenance, tenant/task boundaries, write history, TTL/expiration, and deletions. Key Questions: Did attacker-controlled text persist? Did a later session retrieve it? Did sensitive data cross a user or tenant boundary? Handling Notes: Snapshot before cleansing. Preserve provenance and timestamps; embeddings alone may not reconstruct the original content.

7 - Network and host evidence

DNS, proxy, firewall, EDR, TLS endpoint metadata, outbound destinations, local listener exposure, package installation, process tree, file reads, clipboard events where lawful, and container/VM logs.

Priority: 7 - Network and host evidence Collect / Preserve: DNS, proxy, firewall, EDR, TLS endpoint metadata, outbound destinations, local listener exposure, package installation, process tree, file reads, clipboard events where lawful, and container/VM logs. Key Questions: Did the agent read a sensitive file and then contact an external destination? Was a local HTTP server reachable through browser or network paths? Handling Notes: Normalize clocks and retain raw records. Correlate agent events with endpoint and network evidence rather than treating model telemetry as complete.

8 - Case integrity

Collection time, collector, source system, query/export method, filters, timezone, clock drift, file hashes, storage location, access history, redactions, and known evidence gaps.

Priority: 8 - Case integrity Collect / Preserve: Collection time, collector, source system, query/export method, filters, timezone, clock drift, file hashes, storage location, access history, redactions, and known evidence gaps. Key Questions: Can another investigator reproduce the timeline and distinguish original evidence from analyst interpretation? Handling Notes: Keep raw and normalized copies. Document every transformation and retain a defensible chain of custody.

Minimum viable agent action record

Timestamp + user + device/workload + agent + model/config version + session/correlation ID + source content ID + active tool origin/version/hash + tool name + protected arguments + policy/approval decision + MCP result + memory change + downstream resource/outcome. If a field is unavailable, record the gap and its retention or configuration cause.

First-seen MCP server, tool, origin, package, command, or URL

Compare discovery and configuration against the approved inventory; flag same-name tools from different origins.

Signal: First-seen MCP server, tool, origin, package, command, or URL Correlation / Logic: Compare discovery and configuration against the approved inventory; flag same-name tools from different origins. Why It Matters: Detects shadow servers, typosquatting, unauthorized installs, and supply-chain change. False-Positive Control: Join to approved change tickets and owner registry.

Tool definition or schema hash changed

Diff descriptions, parameters, required fields, examples, destinations and side effects against the approved manifest.

Signal: Tool definition or schema hash changed Correlation / Logic: Diff descriptions, parameters, required fields, examples, destinations and side effects against the approved manifest. Why It Matters: Detects rug pulls and subtle metadata poisoning even when the tool name is unchanged. False-Positive Control: Require signed release metadata and a defined review window.

Sensitive read followed by external write

Within one session or short window, join file/secret/database reads to email, HTTP, repository, messaging, upload or export tools.

Signal: Sensitive read followed by external write Correlation / Logic: Within one session or short window, join file/secret/database reads to email, HTTP, repository, messaging, upload or export tools. Why It Matters: Captures exfiltration sequences that look harmless when each call is evaluated alone. False-Positive Control: Use data classification, approved destination lists, and expected workflow templates.

Tool call lacks declared user intent or approved plan step

Compare the requested action, policy-declared task and tool sequence; flag privileged calls unrelated to the stated goal.

Signal: Tool call lacks declared user intent or approved plan step Correlation / Logic: Compare the requested action, policy-declared task and tool sequence; flag privileged calls unrelated to the stated goal. Why It Matters: Surfaces intent-flow subversion and agent drift. False-Positive Control: Do not require hidden chain-of-thought; use explicit task declarations and auditable plan events.

Tool response contains instruction-like content followed by a new privileged action

Join post-tool content classification to the next pre-tool request and policy decision.

Signal: Tool response contains instruction-like content followed by a new privileged action Correlation / Logic: Join post-tool content classification to the next pre-tool request and policy decision. Why It Matters: Detects response poisoning and indirect prompt injection through MCP results. False-Positive Control: Treat text classification as a lead; confirm with action context and target impact.

Credential or sensitive value in tool parameters, responses or logs

Use secret scanning and DLP before calls and on responses; alert on bypass or transfer to unapproved destinations.

Signal: Credential or sensitive value in tool parameters, responses or logs Correlation / Logic: Use secret scanning and DLP before calls and on responses; alert on bypass or transfer to unapproved destinations. Why It Matters: Blocks a common prompt-injection exfiltration path. False-Positive Control: Tokenize or hash detections and restrict analyst access to raw evidence.

Audience, issuer, scope or consent anomaly

Detect tokens presented to the wrong MCP resource, unexpected scopes, new client registration, token passthrough, or consent without matching client/user.

Signal: Audience, issuer, scope or consent anomaly Correlation / Logic: Detect tokens presented to the wrong MCP resource, unexpected scopes, new client registration, token passthrough, or consent without matching client/user. Why It Matters: Surfaces confused-deputy and stolen-token paths. False-Positive Control: Baseline approved issuers, audiences, clients and tenant relationships.

Unusual retries, fan-out, loop depth or tool-order change

Compare tool count, sequence, retries, destinations and elapsed time with the agent's normal task profile.

Signal: Unusual retries, fan-out, loop depth or tool-order change Correlation / Logic: Compare tool count, sequence, retries, destinations and elapsed time with the agent's normal task profile. Why It Matters: Detects runaway agents, resource exhaustion, cascading failures and compromised planning. False-Positive Control: Use per-agent and per-task baselines, not a global threshold.

Instruction-like memory write later retrieved across task or user boundary

Track memory provenance, writer, tenant, task, retrieval event and resulting tool call.

Signal: Instruction-like memory write later retrieved across task or user boundary Correlation / Logic: Track memory provenance, writer, tenant, task, retrieval event and resulting tool call. Why It Matters: Detects delayed persistence and cross-session influence. False-Positive Control: Require context of a later action; suspicious phrasing alone is not impact.

Agent or remote MCP server lacks user authentication

Inventory configurations and externally reachable listeners; join to sensitive tools and resource access.

Signal: Agent or remote MCP server lacks user authentication Correlation / Logic: Inventory configurations and externally reachable listeners; join to sensitive tools and resource access. Why It Matters: Identifies a high-risk exposure condition before exploitation. False-Positive Control: Document intentionally public, read-only services and prove their capabilities are constrained.

Detection design rule

Prefer behavior and sequence over suspicious words alone. “Ignore previous instructions” can be a useful lead, but the higher-confidence detection is untrusted content followed by an anomalous sensitive read, destination change, privileged call, memory write or completed downstream action.

Session

One prompt, content item or session appears manipulated.

Containment Level: Session Use When: One prompt, content item or session appears manipulated. Actions: Stop the run, preserve session and active tool state, block pending calls, quarantine retrieved content and open a new clean session only after triage. Evidence / Tradeoff: Fast and low impact, but insufficient if the server, credential, memory or definition is shared.

Agent

Behavior drift, repeated anomalous calls, poisoned memory or configuration compromise affects one agent.

Containment Level: Agent Use When: Behavior drift, repeated anomalous calls, poisoned memory or configuration compromise affects one agent. Actions: Pause schedules/queues, disable write tools, freeze memory, revoke the agent identity and preserve container/host state. Evidence / Tradeoff: May interrupt business workflow; retain jobs so investigators can distinguish queued from executed actions.

MCP server

Tool metadata drift, server compromise, unauthenticated exposure or shared malicious response is suspected.

Containment Level: MCP server Use When: Tool metadata drift, server compromise, unauthenticated exposure or shared malicious response is suspected. Actions: Remove from registry, isolate network, block origin/certificate, preserve manifests/logs, revoke server credentials and redirect clients to no replacement until vetted. Evidence / Tradeoff: Can affect many agents; identify every connected client before recovery.

Identity / OAuth

Token theft, audience/scope issue, confused deputy or broad service-context execution is suspected.

Containment Level: Identity / OAuth Use When: Token theft, audience/scope issue, confused deputy or broad service-context execution is suspected. Actions: Revoke grants/tokens, disable registration/session, rotate secrets, reduce scopes and review downstream access. Evidence / Tradeoff: Capture issuance, audience, scope, consent and use metadata before logs expire; avoid retaining usable bearer tokens.

Destination / egress

External transfer, malicious callback, suspicious server or unexpected target is observed.

Containment Level: Destination / egress Use When: External transfer, malicious callback, suspicious server or unexpected target is observed. Actions: Block domain/IP/URL, restrict egress, disable external-send capability and preserve proxy/DNS/firewall records. Evidence / Tradeoff: An attacker may rotate infrastructure; pair with tool and identity containment.

Platform / fleet

A shared SDK, client, registry, package or approval service is compromised.

Containment Level: Platform / fleet Use When: A shared SDK, client, registry, package or approval service is compromised. Actions: Disable affected capability fleet-wide, patch or roll back, invalidate manifests, search all clients and initiate coordinated recovery. Evidence / Tradeoff: High business impact but appropriate for systemic trust failure.

Root cause

Reproduce or clearly explain the manipulation, configuration or vulnerability path.

Gate: Root cause Validation: Reproduce or clearly explain the manipulation, configuration or vulnerability path. Pass Condition: The path is removed or deterministically blocked and the last-known-good state is identified. Do Not Reopen If: The team only restarted the agent or deleted the visible prompt.

Server and tool trust

Verify origin, owner, version, package, manifest hash, definitions, schemas, network behavior and change record.

Gate: Server and tool trust Validation: Verify origin, owner, version, package, manifest hash, definitions, schemas, network behavior and change record. Pass Condition: Approved artifacts match production; drift detection and rollback work. Do Not Reopen If: The server is reachable but its behavior or metadata cannot be attested.

Identity

Issue new task-scoped credentials; verify issuer, audience, scopes, TTL, consent and downstream authorization.

Gate: Identity Validation: Issue new task-scoped credentials; verify issuer, audience, scopes, TTL, consent and downstream authorization. Pass Condition: Old credentials fail; the canary cannot access unrelated resources. Do Not Reopen If: Shared or broad service credentials remain necessary.

Memory and data

Review and quarantine poisoned records; prove tenant/task isolation; validate provenance and sensitive-data handling.

Gate: Memory and data Validation: Review and quarantine poisoned records; prove tenant/task isolation; validate provenance and sensitive-data handling. Pass Condition: Known poisoned content is absent from clean retrieval and legitimate memory can be restored from evidence. Do Not Reopen If: The team cannot identify what persisted or who could retrieve it.

Policy and approval

Replay benign and adversarial calls against allow/deny/approve rules.

Gate: Policy and approval Validation: Replay benign and adversarial calls against allow/deny/approve rules. Pass Condition: High-risk variants block or require independent approval; ordinary read workflows still operate. Do Not Reopen If: Safety depends on the model voluntarily refusing.

Canary

Run a no-secret, isolated agent with read-only tools and enhanced telemetry.

Gate: Canary Validation: Run a no-secret, isolated agent with read-only tools and enhanced telemetry. Pass Condition: Expected sequence, destinations, resource access and evidence appear; no unexplained calls occur. Do Not Reopen If: The team cannot correlate the canary from request to target audit.

Staged production

Restore low-risk reads, then limited writes, then high-impact actions with approvals.

Gate: Staged production Validation: Restore low-risk reads, then limited writes, then high-impact actions with approvals. Pass Condition: Each stage meets monitoring and error budgets with an owner accepting residual risk. Do Not Reopen If: Write access is restored fleet-wide before validation.

User and agent identity

Bind each action to the user and a unique agent/workload identity; do not collapse all activity into one shared service account.

Control: User and agent identity Required Practice: Bind each action to the user and a unique agent/workload identity; do not collapse all activity into one shared service account. Failure It Prevents: Unattributable actions, excessive blast radius and cross-user authority.^{[1] [8] [9]}

Audience-bound access tokens

Issue and validate tokens for the exact MCP resource; reject unrelated audiences and issuers.

Control: Audience-bound access tokens Required Practice: Issue and validate tokens for the exact MCP resource; reject unrelated audiences and issuers. Failure It Prevents: Token replay and confused-deputy access.^{[2] [3]}

No token passthrough

The MCP server validates its inbound token and obtains a separate token for downstream APIs.

Control: No token passthrough Required Practice: The MCP server validates its inbound token and obtains a separate token for downstream APIs. Failure It Prevents: Control bypass, loss of accountability and downstream misuse.^{[2] [3]}

OAuth flow integrity

Use PKCE, exact redirect URI matching, secure state, protected-resource metadata and per-client consent.

Control: OAuth flow integrity Required Practice: Use PKCE, exact redirect URI matching, secure state, protected-resource metadata and per-client consent. Failure It Prevents: Authorization-code interception, consent bypass and malicious client registration abuse.^{[2] [3]}

Scope minimization

Separate read, write, send, delete and administer scopes; issue short-lived just-in-time access.

Control: Scope minimization Required Practice: Separate read, write, send, delete and administer scopes; issue short-lived just-in-time access. Failure It Prevents: A low-risk task inheriting unrelated high-impact authority.^{[1] [2] [3]}

Credential storage and logging

Store secrets in managed secure storage; never log authorization headers, raw tokens, codes or long-lived keys.

Control: Credential storage and logging Required Practice: Store secrets in managed secure storage; never log authorization headers, raw tokens, codes or long-lived keys. Failure It Prevents: Credential theft through logs, prompts, tool parameters and case artifacts.^{[2] [3] [11]}

Server origin and identity

Owner, URL/command, package/source, certificate/key, environment and approved clients.

Governed Artifact: Server origin and identity Baseline: Owner, URL/command, package/source, certificate/key, environment and approved clients. Change Trigger: New origin, certificate, command, package owner, redirect or network path. Enforcement: Block and require security reapproval.

Tool manifest

Tool names, namespace, descriptions, input/output schemas, examples, side effects and risk tier.

Governed Artifact: Tool manifest Baseline: Tool names, namespace, descriptions, input/output schemas, examples, side effects and risk tier. Change Trigger: Any text, parameter, required field, default, scope, destination or side-effect change. Enforcement: Diff before model exposure; sign/hash; version and reapprove material changes.

Runtime implementation

Code/package/container digest, dependencies, SBOM, network behavior and release provenance.

Governed Artifact: Runtime implementation Baseline: Code/package/container digest, dependencies, SBOM, network behavior and release provenance. Change Trigger: New build, dependency, image, outbound destination or execution behavior. Enforcement: Supply-chain scan, canary, egress policy and rollback.

Agent capability set

Task-required tools only, with identity, scopes, budgets and approval class.

Governed Artifact: Agent capability set Baseline: Task-required tools only, with identity, scopes, budgets and approval class. Change Trigger: New tool, shadow name, broader scope, write/delete/send ability or workflow fan-out. Enforcement: Policy deny by default; owner approval and threat-model update.

Deprecation and removal

End-of-life date, replacement, client list and credential retirement plan.

Governed Artifact: Deprecation and removal Baseline: End-of-life date, replacement, client list and credential retirement plan. Change Trigger: Ownerless, unmaintained, vulnerable or unused capability. Enforcement: Remove registry entry, revoke credentials, block origin and verify no clients remain.

Sensitive data enters context or tool parameters.

Classify at ingestion; attach provenance; minimize, mask or tokenize before model/tool use; restrict destinations by class.

Risk: Sensitive data enters context or tool parameters. Required Design: Classify at ingestion; attach provenance; minimize, mask or tokenize before model/tool use; restrict destinations by class. Investigation Question: Which sensitive fields crossed which boundary and where were they retained? Recovery Action: Revoke exposed credentials, notify data owners, remove unauthorized copies and validate DLP/retention.

One user or tenant sees another's context.

Separate memory namespaces, retrieval indexes, caches and encryption/access controls by tenant and task.

Risk: One user or tenant sees another's context. Required Design: Separate memory namespaces, retrieval indexes, caches and encryption/access controls by tenant and task. Investigation Question: Which writes were retrievable by whom, and did a later session retrieve them? Recovery Action: Snapshot, isolate affected namespace, rebuild indexes and prove access boundaries.

Instruction-like content persists.

Record source, writer, trust, classification, TTL and write reason; quarantine untrusted instructions and avoid storing them as policy.

Risk: Instruction-like content persists. Required Design: Record source, writer, trust, classification, TTL and write reason; quarantine untrusted instructions and avoid storing them as policy. Investigation Question: Which source seeded the memory and which later actions relied on it? Recovery Action: Quarantine or roll back records, retest retrieval and add provenance-aware policy.

Stale or revoked facts continue to drive action.

TTL, versioning, authoritative-source checks, invalidation and review for high-impact facts.

Risk: Stale or revoked facts continue to drive action. Required Design: TTL, versioning, authoritative-source checks, invalidation and review for high-impact facts. Investigation Question: Was the decision based on an obsolete authorization, target, owner or policy? Recovery Action: Invalidate records and require fresh authoritative retrieval before action.

Evidence is destroyed during cleanup.

Separate operational deletion from evidence preservation; support snapshots and legal hold.

Risk: Evidence is destroyed during cleanup. Required Design: Separate operational deletion from evidence preservation; support snapshots and legal hold. Investigation Question: Was memory changed after detection, by whom and under what case authority? Recovery Action: Preserve raw snapshot, document transformations and rebuild clean operational memory separately.

Delete, overwrite, disable, revoke or destroy

Human approval required.

Action Class: Delete, overwrite, disable, revoke or destroy Default: Human approval required. What Approver Must See: Exact target, scope, before/after effect, rollback, agent/user identity and evidence. Non-Bypass Requirement: Approval service is outside the agent's editable context; execution token issued only after approval.

Privilege, identity, policy or secret change

Human approval + separation of duties.

Action Class: Privilege, identity, policy or secret change Default: Human approval + separation of duties. What Approver Must See: Requested role/scope, duration, beneficiary, reason, conflicts and downstream reach. Non-Bypass Requirement: Agent cannot approve, rewrite justification, alter recipient or reuse approval for another resource.

External send, publish, upload or financial transaction

Approval above data/value/recipient threshold.

Action Class: External send, publish, upload or financial transaction Default: Approval above data/value/recipient threshold. What Approver Must See: Recipient/destination, data classification, attachment/payload, amount, source and legal/business context. Non-Bypass Requirement: Destination and payload are cryptographically or transactionally bound to the approved request.

Production code, configuration or infrastructure change

Existing change-control and peer-review policy applies.

Action Class: Production code, configuration or infrastructure change Default: Existing change-control and peer-review policy applies. What Approver Must See: Diff, tests, blast radius, environment, rollback and generated-versus-human changes. Non-Bypass Requirement: Agent cannot merge/deploy outside protected branch, CI/CD or cloud policy.

Read-only low-sensitivity lookup

May be autonomous within scope and budget.

Action Class: Read-only low-sensitivity lookup Default: May be autonomous within scope and budget. What Approver Must See: No per-call approval if preauthorized; inventory and audit remain required. Non-Bypass Requirement: Read-only identity and downstream enforcement prevent hidden write/send side effects.

Named owner and business purpose

Agent/model/client/server/tool versions

Identity, scopes, data and downstream systems

Kill switch, rollback and retention owner

Approved origin and installation command

Authenticated transport and server identity

Pinned/signed manifest and drift alert

No unauthenticated capability enumeration

Strict typed schemas and bounded inputs

Path, command and destination allowlists

DLP/secret redaction before and after tools

Sandbox, egress controls, rates and budgets

Unique agent/workload identity

Short-lived, audience-bound tokens

Separate downstream credentials

No shared admin service account or token passthrough

Provenance and trust label at ingestion

Tenant/task isolation

Classification-aware flows and retention

Memory quarantine, TTL and rollback

Independent approval service

Exact target/payload shown to approver

Immutable approval and execution record

Safe default when approver or policy is unavailable

Common session/correlation IDs

Pre-tool, policy, approval and post-tool events

Identity/network/target audit correlation

Tested export, time sync and retention

Severity and escalation criteria

Pause/isolate/revoke procedures

Forensic collection order and evidence store

Canary recovery and tabletop completed

What does MCP change?

MCP gives clients a standardized way to discover and call server-provided tools, resources and prompts. The security consequence is that tool metadata, server identity, transport, authorization, returned content and downstream privileges all become part of the agent's trust path.

Question: What does MCP change? Answer: MCP gives clients a standardized way to discover and call server-provided tools, resources and prompts. The security consequence is that tool metadata, server identity, transport, authorization, returned content and downstream privileges all become part of the agent's trust path.^{[1] [2] [3]}

Are MCP servers inherently unsafe?

No. Risk depends on who operates the server, how it is installed and updated, which identity it uses, what tools and data it exposes, whether calls are policy-checked, and whether activity is logged. A constrained read-only server is not equivalent to an unauthenticated server with shell, cloud-admin or external-send capability.

Question: Are MCP servers inherently unsafe? Answer: No. Risk depends on who operates the server, how it is installed and updated, which identity it uses, what tools and data it exposes, whether calls are policy-checked, and whether activity is logged. A constrained read-only server is not equivalent to an unauthenticated server with shell, cloud-admin or external-send capability.^{[2] [3] [7]}

Is a local stdio server safer than a remote server?

It removes some remote-network and OAuth exposure, but it may execute with the MCP client's local privileges and can read files or launch processes if not sandboxed. Remote HTTP servers require strong authentication, token validation, transport security and server-side authorization; local servers require installation consent, command visibility, sandboxing and minimal host access.

Question: Is a local stdio server safer than a remote server? Answer: It removes some remote-network and OAuth exposure, but it may execute with the MCP client's local privileges and can read files or launch processes if not sandboxed. Remote HTTP servers require strong authentication, token validation, transport security and server-side authorization; local servers require installation consent, command visibility, sandboxing and minimal host access.^{[2] [3] [13] [14]}

Can prompt filtering solve agent security?

No. Prompt and response inspection can reduce risk, but controls must also enforce identity, data flow, tool arguments, destinations, rate limits, version trust, approval and downstream authorization. Model refusal or system-prompt language is not a deterministic action boundary.

Question: Can prompt filtering solve agent security? Answer: No. Prompt and response inspection can reduce risk, but controls must also enforce identity, data flow, tool arguments, destinations, rate limits, version trust, approval and downstream authorization. Model refusal or system-prompt language is not a deterministic action boundary.^{[1] [4] [6] [10] [12]}

Do responders need private chain-of-thought?

No. Investigators need attributable operational evidence: the user request, relevant retrieved content, model and configuration version, tool definitions, pre-tool request, policy decision, approval, tool result, memory changes and downstream audit. Do not claim to preserve hidden reasoning that the platform does not expose.

Question: Do responders need private chain-of-thought? Answer: No. Investigators need attributable operational evidence: the user request, relevant retrieved content, model and configuration version, tool definitions, pre-tool request, policy decision, approval, tool result, memory changes and downstream audit. Do not claim to preserve hidden reasoning that the platform does not expose.^{[1] [8] [10]}

What makes an agent event a security incident?

A blocked injection may be a detection event; an unauthorized tool attempt is a policy incident; a completed privileged action, data access, secret exposure, external transfer, persistence or destructive change can be a security incident. Severity depends on actual authority, action and impact, not dramatic model output.

Question: What makes an agent event a security incident? Answer: A blocked injection may be a detection event; an unauthorized tool attempt is a policy incident; a completed privileged action, data access, secret exposure, external transfer, persistence or destructive change can be a security incident. Severity depends on actual authority, action and impact, not dramatic model output.^{[5] [8] [10]}

What is the first containment action?

Stop new action while preserving state: pause the affected agent and queues, disable or quarantine suspect tools/servers, capture volatile evidence, and revoke affected credentials or grants. Avoid deleting memory, logs or configuration until snapshots are preserved.

Question: What is the first containment action? Answer: Stop new action while preserving state: pause the affected agent and queues, disable or quarantine suspect tools/servers, capture volatile evidence, and revoke affected credentials or grants. Avoid deleting memory, logs or configuration until snapshots are preserved.^{[1] [2] [8]}

What is the minimum useful logging?

Identity, timestamp, agent/model/configuration version, session and correlation IDs, tool origin/name/version, arguments after protected handling, policy and approval result, tool response classification, memory writes, target resource and outcome. Retention must cover the likely detection delay.

Question: What is the minimum useful logging? Answer: Identity, timestamp, agent/model/configuration version, session and correlation IDs, tool origin/name/version, arguments after protected handling, policy and approval result, tool response classification, memory writes, target resource and outcome. Retention must cover the likely detection delay.^{[1] [8] [10] [12]}

AI agent

A system that uses a model to plan and take one or more actions through tools or connected services.

Term: AI agent Plain-Language Meaning: A system that uses a model to plan and take one or more actions through tools or connected services. Security Use: Treat as a non-human workload with identity, authority, data access, audit and an accountable owner.

Model Context Protocol (MCP)

A standard way for AI applications to discover and use server-provided tools, resources and prompts.

Term: Model Context Protocol (MCP) Plain-Language Meaning: A standard way for AI applications to discover and use server-provided tools, resources and prompts. Security Use: Govern client, server, transport, authorization, definitions, versions, tool calls and results.

MCP client / host

The application that connects an agent or model experience to MCP servers.

Term: MCP client / host Plain-Language Meaning: The application that connects an agent or model experience to MCP servers. Security Use: Controls installation, discovery, user consent, server trust and which capabilities reach the model.

MCP server

A local or remote service exposing tools, resources or prompts to an MCP client.

Term: MCP server Plain-Language Meaning: A local or remote service exposing tools, resources or prompts to an MCP client. Security Use: Authenticate, constrain, version, monitor and treat as a supply-chain and execution component.

Tool

A named capability the model may request, described with metadata and a parameter schema.

Term: Tool Plain-Language Meaning: A named capability the model may request, described with metadata and a parameter schema. Security Use: The description influences selection; arguments and execution require independent policy.

Indirect prompt injection

Instructions hidden in external content that the model reads while performing another task.

Term: Indirect prompt injection Plain-Language Meaning: Instructions hidden in external content that the model reads while performing another task. Security Use: Assume untrusted content can influence the model; contain what that influence is allowed to do.

Tool poisoning

Malicious or misleading instructions embedded in tool metadata or schemas.

Term: Tool poisoning Plain-Language Meaning: Malicious or misleading instructions embedded in tool metadata or schemas. Security Use: Scan, diff and approve definitions before showing them to the model.

Tool shadowing

One tool's metadata changes how the model uses another tool, or a look-alike competes with it.

Term: Tool shadowing Plain-Language Meaning: One tool's metadata changes how the model uses another tool, or a look-alike competes with it. Security Use: Namespace tools by origin, eliminate collisions and expose only task-required capabilities.

Rug pull

A server or tool changes after it was trusted.

Term: Rug pull Plain-Language Meaning: A server or tool changes after it was trusted. Security Use: Pin, attest, diff, canary and reapprove behavioral changes.

Non-human identity (NHI)

An identity used by an agent, workload, service or automation rather than a person.

Term: Non-human identity (NHI) Plain-Language Meaning: An identity used by an agent, workload, service or automation rather than a person. Security Use: Make it unique, short-lived, least-privileged and attributable to a user/task/owner.

Information-flow control

Rules governing where data may move based on its classification, source and destination.

Term: Information-flow control Plain-Language Meaning: Rules governing where data may move based on its classification, source and destination. Security Use: Prevent sensitive data from entering unapproved prompts, tools, memory, logs or external systems.

Capability drift

A change in tools, definitions, schemas, permissions, model, memory or execution sequence.

Term: Capability drift Plain-Language Meaning: A change in tools, definitions, schemas, permissions, model, memory or execution sequence. Security Use: Detect against an approved baseline and require review before high-risk changes.

Unauthenticated remote MCP exposure

Microsoft reports observing remote MCP servers without authentication that exposed sensitive internal tools; it reported 15% of remote servers in its signals as severely insecure.

Signal / Example: Unauthenticated remote MCP exposure What Is Established: Microsoft reports observing remote MCP servers without authentication that exposed sensitive internal tools; it reported 15% of remote servers in its signals as severely insecure. What It Does Not Prove: It is not a universal prevalence measure for every MCP deployment or organization. Decision Use: Prioritize external exposure discovery, authentication, user-context execution and least privilege.^[7]

Secret leakage through public-repository content

GitHub added scanning of remote MCP tool-call inputs for detectable secrets and described public repository content as a prompt-injection path.

Signal / Example: Secret leakage through public-repository content What Is Established: GitHub added scanning of remote MCP tool-call inputs for detectable secrets and described public repository content as a prompt-injection path. What It Does Not Prove: Secret scanning does not stop non-secret data leakage, every tool channel or model-only behavior. Decision Use: Place DLP/secret checks at the tool boundary and restrict local secret access.^[11]

Runtime inspection checkpoints

Microsoft documents inspection at user prompt, pre-tool request and post-tool response for supported local agents.

Signal / Example: Runtime inspection checkpoints What Is Established: Microsoft documents inspection at user prompt, pre-tool request and post-tool response for supported local agents. What It Does Not Prove: Coverage is platform/agent dependent and is not a replacement for downstream audit or deterministic authorization. Decision Use: Instrument the agent loop and validate exact product coverage before relying on a control.^[10]

Deterministic MCP control-plane research

Microsoft's public-preview AGT work demonstrates definition scanning, per-call policy, response inspection, identity, gating and replayable audit concepts.

Signal / Example: Deterministic MCP control-plane research What Is Established: Microsoft's public-preview AGT work demonstrates definition scanning, per-call policy, response inspection, identity, gating and replayable audit concepts. What It Does Not Prove: Public preview does not establish complete workflow-sequence coverage or universal production readiness. Decision Use: Adopt the architectural pattern; evaluate implementation maturity and known limitations separately.^[12]

CVE-2025-49596

MCP Inspector versions below 0.14.1 lacked authentication between the Inspector client and proxy, enabling unauthenticated requests to launch MCP commands over stdio.

Record: CVE-2025-49596 Affected Condition: MCP Inspector versions below 0.14.1 lacked authentication between the Inspector client and proxy, enabling unauthenticated requests to launch MCP commands over stdio. Security Meaning: Agentic controls do not replace ordinary patching and authentication. Developer tooling can become a host code-execution path. Action: Upgrade to 0.14.1 or later; search for exposed Inspector/proxy use; preserve process and command evidence if exposure is suspected. KEV Status: No CISA KEV listing is asserted by this brief.^[13]

CVE-2025-66416

Before MCP Python SDK 1.23.0, specified local HTTP/SSE or streamable-HTTP configurations without authentication and transport security could be exposed to DNS rebinding.

Record: CVE-2025-66416 Affected Condition: Before MCP Python SDK 1.23.0, specified local HTTP/SSE or streamable-HTTP configurations without authentication and transport security could be exposed to DNS rebinding. Security Meaning: A service bound to localhost is not automatically safe when a browser can reach it through a rebinding path. Action: Upgrade to 1.23.0 or later; prefer stdio for local-only use where appropriate; authenticate HTTP servers and enable transport security. KEV Status: No CISA KEV listing is asserted by this brief.^[14]

CVE boundary

These CVEs concern MCP-related implementations and configurations. They do not prove that MCP as a protocol is compromised, that every affected installation was exposed, or that exploitation occurred in a specific environment.

Adversarial instructions alter agent behavior.

Initial influence / prompt injection / indirect prompt injection.

Behavior: Adversarial instructions alter agent behavior. ATT&CK / ATLAS Lens: Initial influence / prompt injection / indirect prompt injection. Observable Evidence: Source content, retrieval event, safety signal, task drift, next tool call. Boundary: A suspicious instruction is not impact until it changes action or output in a material way.

Agent reads or exposes credentials.

Credential Access; sensitive-data disclosure.

Behavior: Agent reads or exposes credentials. ATT&CK / ATLAS Lens: Credential Access; sensitive-data disclosure. Observable Evidence: File/secret access, tool arguments, DLP/secret scan, model/tool response, downstream authentication. Boundary: A detector hit should be validated against actual secret material and access/use.

MCP tool launches a command or modifies a system.

Execution; privilege use; tool-mediated action.

Behavior: MCP tool launches a command or modifies a system. ATT&CK / ATLAS Lens: Execution; privilege use; tool-mediated action. Observable Evidence: Pre-tool call, policy result, server log, process tree, command, target audit. Boundary: Separate proposed, blocked, attempted and completed execution.

Poisoned memory or scheduled task influences later activity.

Persistence; model/agent memory poisoning.

Behavior: Poisoned memory or scheduled task influences later activity. ATT&CK / ATLAS Lens: Persistence; model/agent memory poisoning. Observable Evidence: Memory write, provenance, later retrieval, queue/schedule and subsequent action. Boundary: Persisted text alone is not proof that a later action relied on it.

Sensitive data moves to an external tool, recipient or server.

Collection and Exfiltration.

Behavior: Sensitive data moves to an external tool, recipient or server. ATT&CK / ATLAS Lens: Collection and Exfiltration. Observable Evidence: Sensitive read, tool payload, proxy/DNS/network, recipient/destination and target audit. Boundary: Model output that mentions data is different from completed external transfer.

Agent deletes, changes, sends, deploys or transacts at scale.

Impact; excessive agency; cascading action.

Behavior: Agent deletes, changes, sends, deploys or transacts at scale. ATT&CK / ATLAS Lens: Impact; excessive agency; cascading action. Observable Evidence: Approvals, transaction IDs, change logs, before/after state, retries/fan-out and business effect. Boundary: Use target-system evidence to measure impact.

This card is a defensive behavior crosswalk, not an attribution claim and not a substitute for validating the exact current technique IDs used by an organization's ATT&CK or ATLAS implementation.

Tier 0 - Protocol, government, framework, and vulnerability records

6

Tier: Tier 0 - Protocol, government, framework, and vulnerability records Checked: 6 Useful Hits: 6 Used: 6 Not Used: 0

Tier 1 - Primary guide and platform security sources

6

Tier: Tier 1 - Primary guide and platform security sources Checked: 6 Useful Hits: 6 Used: 6 Not Used: 0

Tier 2 - Emerging control research

1

Tier: Tier 2 - Emerging control research Checked: 1 Useful Hits: 1 Used: 1 Not Used: 0

Tier 3 - Corroborating journalism

0

Tier: Tier 3 - Corroborating journalism Checked: 0 Useful Hits: 0 Used: 0 Not Used: 0

Tier 4 - Community signal

0

Tier: Tier 4 - Community signal Checked: 0 Useful Hits: 0 Used: 0 Not Used: 0

Tier 5 - User-supplied source

1

Tier: Tier 5 - User-supplied source Checked: 1 Useful Hits: 1 Used: 1 Not Used: 0

Tier 6 - API / private integration

0

Tier: Tier 6 - API / private integration Checked: 0 Useful Hits: 0 Used: 0 Not Used: 0

Tier 7 - Inner discovery / carved URLs

0

Tier: Tier 7 - Inner discovery / carved URLs Checked: 0 Useful Hits: 0 Used: 0 Not Used: 0

Tier 8 - Expansion research not promoted to the retained set

0

Tier: Tier 8 - Expansion research not promoted to the retained set Checked: 0 Useful Hits: 0 Used: 0 Not Used: 0

Total distinct retained sources

14

Tier: Total distinct retained sources Checked: 14 Useful Hits: 14 Used: 14 Not Used: 0

Where is the security boundary?

CrowdStrike, MCP, OWASP and Microsoft agree that agent inputs, tool metadata, identity, execution and responses create a broader trust path than a conventional chat interface.

Question: Where is the security boundary? Source Agreement: CrowdStrike, MCP, OWASP and Microsoft agree that agent inputs, tool metadata, identity, execution and responses create a broader trust path than a conventional chat interface. Important Difference: CrowdStrike emphasizes reasoning-layer controls; MCP documentation provides protocol-specific authorization and deployment requirements. PANDA Treatment: Use the guide for architecture; use MCP documents for normative protocol claims.

Does traditional AppSec still matter?

The guide explains why static and syntax-oriented controls miss semantic influence; NVD and Microsoft show ordinary authentication, patching, network and configuration failures remain consequential.

Question: Does traditional AppSec still matter? Source Agreement: The guide explains why static and syntax-oriented controls miss semantic influence; NVD and Microsoft show ordinary authentication, patching, network and configuration failures remain consequential. Important Difference: “AppSec is insufficient” does not mean “AppSec is obsolete.” PANDA Treatment: Require both agent-specific and conventional software/identity/network controls.

What telemetry is practical?

CrowdStrike recommends end-to-end planning/tool observability; Microsoft shows current inventory and prompt/tool checkpoints in supported products.

Question: What telemetry is practical? Source Agreement: CrowdStrike recommends end-to-end planning/tool observability; Microsoft shows current inventory and prompt/tool checkpoints in supported products. Important Difference: Product-specific tables and hooks are not universal and may be preview capabilities. PANDA Treatment: Define platform-neutral evidence requirements and label Microsoft telemetry as an implementation example.

Can model instructions enforce policy?

OWASP, Microsoft and the guide support layered controls; Microsoft's AGT work explicitly argues for deterministic per-call enforcement.

Question: Can model instructions enforce policy? Source Agreement: OWASP, Microsoft and the guide support layered controls; Microsoft's AGT work explicitly argues for deterministic per-call enforcement. Important Difference: AGT is public preview and acknowledges incomplete workflow-sequence coverage. PANDA Treatment: Adopt the architectural principle without presenting one product as complete.

How should an incident be investigated?

The guide calls for agent-specific IR; Microsoft provides concrete scoping, correlation, hunting and evidence-export examples; NIST supports incident disclosure and governance.

Question: How should an incident be investigated? Source Agreement: The guide calls for agent-specific IR; Microsoft provides concrete scoping, correlation, hunting and evidence-export examples; NIST supports incident disclosure and governance. Important Difference: Microsoft's playbook is scoped to its services and licensing. PANDA Treatment: Translate it into a vendor-neutral preservation, scoping, containment and recovery playbook.

CrowdStrike supplied ebook

35% - primary structure and teaching model.

Source Class: CrowdStrike supplied ebook Editorial Weight: 35% - primary structure and teaching model. What It Controls: Attack chain, core failure modes, five-layer hardening concepts and 90-day sequencing. Limit: Vendor guide with product positioning; it is not the MCP specification or a universal incident dataset.

MCP specification and security guidance

20% - highest for protocol requirements.

Source Class: MCP specification and security guidance Editorial Weight: 20% - highest for protocol requirements. What It Controls: Authorization, token audience, passthrough, consent, redirects, sessions, local installation and sandboxing. Limit: Does not provide a complete enterprise governance or forensic operating model.

NIST and OWASP

15% - governance and threat-model anchor.

Source Class: NIST and OWASP Editorial Weight: 15% - governance and threat-model anchor. What It Controls: Risk lifecycle, testing, incident disclosure, agentic threat classes and defense-in-depth. Limit: Framework guidance must be translated into environment-specific technical controls.

Microsoft and GitHub primary platform sources

20% - current implementation and investigation examples.

Source Class: Microsoft and GitHub primary platform sources Editorial Weight: 20% - current implementation and investigation examples. What It Controls: Observed exposure patterns, prompt/tool checkpoints, inventory, evidence fields, secret scanning and deterministic policy examples. Limit: Coverage, licensing, preview status and platform specificity are retained.

NVD vulnerability records

10% - implementation-specific urgency.

Source Class: NVD vulnerability records Editorial Weight: 10% - implementation-specific urgency. What It Controls: Affected versions/conditions and remediation for two MCP-related software flaws. Limit: CVE presence does not establish exploitation, universal MCP exposure or KEV status.

Editorial weights describe how this brief was composed; they are not statistical confidence scores.

Flash Threat Intel Brief

Operational exposure where connected AI workflow infrastructure can reach models, data, cloud services and credentials.

Rolling Intelligence Card

Ongoing source-backed activity and conclusions about AI-enabled offensive behavior.

Create an account and sign-in to use this card.

Record your personal notes and comments in this card related to this brief.

July 26, 2024

NIST publishes the Generative AI Profile for the AI Risk Management Framework.

Date: July 26, 2024 Source-Backed Milestone: NIST publishes the Generative AI Profile for the AI Risk Management Framework. Why It Matters: Establishes the government risk-management baseline used here for governance, measurement, management, testing, provenance, and incident disclosure.^[5]

February 17, 2025

OWASP publishes its agentic AI threats and mitigations resource.

Date: February 17, 2025 Source-Backed Milestone: OWASP publishes its agentic AI threats and mitigations resource. Why It Matters: Provides a public threat-model frame for excessive agency, tools, memory, identity, and multi-agent interaction.^[4]

June 13, 2025

NVD publishes CVE-2025-49596 for unauthenticated remote code execution affecting MCP Inspector versions below 0.14.1.

Date: June 13, 2025 Source-Backed Milestone: NVD publishes CVE-2025-49596 for unauthenticated remote code execution affecting MCP Inspector versions below 0.14.1. Why It Matters: Demonstrates that an MCP-adjacent management surface can create a concrete remote-execution exposure when authentication is missing.^[13]

December 2, 2025

NVD publishes CVE-2025-66416 for DNS-rebinding exposure in affected MCP Python SDK deployments.

Date: December 2, 2025 Source-Backed Milestone: NVD publishes CVE-2025-66416 for DNS-rebinding exposure in affected MCP Python SDK deployments. Why It Matters: Shows why local-server assumptions must be tested against browser and network reachability.^[14]

April 22-May 14, 2026

Microsoft publishes MCP control-plane guidance and field research on exploitable AI-application misconfiguration.

Date: April 22-May 14, 2026 Source-Backed Milestone: Microsoft publishes MCP control-plane guidance and field research on exploitable AI-application misconfiguration. Why It Matters: Connects the conceptual risk model to enforceable per-call policy, identity, discovery, and workload-hardening practices.^{[7] [12]}

June-July 2026

Microsoft publishes AI investigation, local-agent discovery, and runtime-protection guidance used for this brief's response and evidence model.

Date: June-July 2026 Source-Backed Milestone: Microsoft publishes AI investigation, local-agent discovery, and runtime-protection guidance used for this brief's response and evidence model. Why It Matters: Provides current operational examples for inventory, correlation, evidence export, inspection, blocking, and investigation.^{[8] [9] [10]}

IP addresses

No topic-wide malicious IP list published

Category: IP addresses Availability: No topic-wide malicious IP list published What to Preserve or Detect: Preserve remote MCP server addresses, proxy destinations, callback infrastructure, and the source/destination context for each tool invocation.

Domains / FQDNs

No topic-wide malicious domain list published

Category: Domains / FQDNs Availability: No topic-wide malicious domain list published What to Preserve or Detect: Record MCP server origins, authorization-server domains, redirect hosts, package registries, and downstream service domains.

URLs

Environment-specific

Category: URLs Availability: Environment-specific What to Preserve or Detect: Retain server endpoints, protected-resource metadata URLs, redirect URIs, retrieved-content URLs, and downstream action targets.

Filenames

Environment-specific

Category: Filenames Availability: Environment-specific What to Preserve or Detect: Collect MCP configuration files, manifests, package metadata, agent configuration, exported traces, and policy bundles.

Hashes

No topic-wide malicious hash set published

Category: Hashes Availability: No topic-wide malicious hash set published What to Preserve or Detect: Hash installed server packages, tool binaries, manifests, configuration snapshots, and exported evidence so later changes are provable.

Persistence

Implementation-dependent

Category: Persistence Availability: Implementation-dependent What to Preserve or Detect: Review startup entries, scheduled jobs, package auto-update paths, server registration, memory stores, and durable OAuth grants.

Host artifacts

Implementation-dependent

Category: Host artifacts Availability: Implementation-dependent What to Preserve or Detect: Capture process trees, command lines, package paths, local listening ports, configuration, environment variables, and endpoint telemetry.

Identity / session evidence

Required investigation evidence

Category: Identity / session evidence Availability: Required investigation evidence What to Preserve or Detect: Retain user and workload identity, token audience and scopes, consent, approvals, session and correlation IDs, grant changes, and revocation events.

Network behavior

Required investigation evidence

Category: Network behavior Availability: Required investigation evidence What to Preserve or Detect: Monitor new server origins, unexpected redirects, cross-boundary retrieval, unusual egress, repeated tool calls, and downstream access outside the expected resource set.

Behavioral detections

Primary detection lane

Category: Behavioral detections Availability: Primary detection lane What to Preserve or Detect: Alert on tool-definition drift, unauthorized tool selection, blocked secrets, risky argument/destination combinations, approval bypass, memory poisoning, and action sequences inconsistent with the user's request.

V1.0

26-Jul-2026

Version: V1.0 Date: 26-Jul-2026 Change: Initial PANDA Risk Educational Brief on agentic AI and MCP server security. Added architecture and trust boundaries, risk model, attack chain, 90-day roadmap, incident response playbook, forensic evidence guide, detections, containment, recovery, identity and token controls, tool drift governance, memory security, secure deployment checklist, CVE records, source reconciliation and citations.

1

AI Agent Security: Architecture, Attack Surface, and Defense

#: 1 Source: AI Agent Security: Architecture, Attack Surface, and Defense Publisher: CrowdStrike Published: 2025 Why Used: Primary teaching source supplied for this brief. Establishes the agent attack chain, MCP trust-boundary changes, tool poisoning, tool shadowing, rug-pull risk, a five-layer hardening model, and the 90-day implementation sequence.

2

Security Best Practices

#: 2 Source: Security Best Practices Publisher: Model Context Protocol Published: Living documentation; accessed Jul 26, 2026 Why Used: Authoritative MCP guidance for confused-deputy risk, token passthrough, session handling, consent, redirect validation, local-server execution, sandboxing, scope minimization, and secure deployment.

3

Authorization Specification

#: 3 Source: Authorization Specification Publisher: Model Context Protocol Published: Jun 18, 2025 specification Why Used: Authoritative requirements for HTTP authorization, OAuth 2.1, PKCE, protected-resource metadata, token audience binding, token validation, HTTPS, and the prohibition on token passthrough.

4

Agentic AI - Threats and Mitigations

#: 4 Source: Agentic AI - Threats and Mitigations Publisher: OWASP GenAI Security Project Published: Feb 17, 2025 Why Used: Threat-model reference for agentic systems and mitigations across autonomous planning, tools, identity, memory, multi-agent interaction, and excessive agency.

5

Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1)

#: 5 Source: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) Publisher: NIST Published: Jul 26, 2024 Why Used: Government risk-management frame for governance, mapping, measurement, management, predeployment testing, content provenance, and incident disclosure.

6

Protecting against indirect prompt injection attacks in MCP

#: 6 Source: Protecting against indirect prompt injection attacks in MCP Publisher: Microsoft Published: Apr 28, 2025 Why Used: Primary platform guidance explaining indirect prompt injection, tool poisoning, hosted-server rug pulls, prompt shielding, and supply-chain controls.

7

When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps

#: 7 Source: When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps Publisher: Microsoft Security Published: May 14, 2026 Why Used: Current field evidence for unauthenticated remote MCP exposure, service-context execution, and the need for workload inventory, user-context authorization, and least privilege.

8

See What Happened: A Practitioner's Playbook for Microsoft 365 Copilot and Azure AI Services

#: 8 Source: See What Happened: A Practitioner's Playbook for Microsoft 365 Copilot and Azure AI Services Publisher: Microsoft AeGIS Published: Jun 2026 Why Used: Investigation guidance for telemetry readiness, user/time/resource scoping, prompt-injection and credential-exposure signals, agent and MCP inventory, correlation identifiers, evidence export, and human validation.

9

Local AI agent discovery

#: 9 Source: Local AI agent discovery Publisher: Microsoft Defender for Endpoint Published: Updated Jun 18, 2026 Why Used: Current example of discovering local agents, MCP configurations, user/device associations, and reachable resources as an exposure map.

10

AI agent runtime protection

#: 10 Source: AI agent runtime protection Publisher: Microsoft Defender for Endpoint Published: Updated Jul 2, 2026 Why Used: Current example of inspection at user-prompt, pre-tool-call, and post-tool-response checkpoints, plus audit/block deployment and investigation workflow.

11

GitHub MCP Server: Secret scanning, push protection, and more

#: 11 Source: GitHub MCP Server: Secret scanning, push protection, and more Publisher: GitHub Published: Aug 13, 2025 Why Used: Concrete example of inspecting MCP tool-call inputs and blocking detectable secrets before public-repository workflows can exfiltrate them.

12

Securing MCP: A Control Plane for Agent Tool Execution

#: 12 Source: Securing MCP: A Control Plane for Agent Tool Execution Publisher: Microsoft for Developers Published: Apr 22, 2026 Why Used: Emerging implementation example for deterministic per-call policy, tool-definition scanning, response inspection, identity, execution gating, and replayable audit logs. Public-preview limitations are retained.

13

CVE-2025-49596 - MCP Inspector unauthenticated remote code execution

#: 13 Source: CVE-2025-49596 - MCP Inspector unauthenticated remote code execution Publisher: NIST National Vulnerability Database Published: Jun 13, 2025; modified Jun 17, 2026 Why Used: Authoritative vulnerability record for missing authentication between MCP Inspector client and proxy in versions below 0.14.1.

14

CVE-2025-66416 - MCP Python SDK DNS rebinding protection

#: 14 Source: CVE-2025-66416 - MCP Python SDK DNS rebinding protection Publisher: NIST National Vulnerability Database Published: Dec 2, 2025; modified Jun 17, 2026 Why Used: Authoritative vulnerability record for DNS rebinding exposure in HTTP-based local MCP servers using affected Python SDK versions before 1.23.0 under specified conditions.

Primary Supplied Guide

The CrowdStrike ebook supplied by the user is the principal starting point and receives the largest editorial weight. The linked CrowdStrike resource page is retained as the public citation.

Protocol, Framework, Operational, and Vulnerability Sources

These sources validate, qualify or extend the primary guide. MCP documentation controls protocol claims; NIST and OWASP control framework interpretation; platform sources provide current implementation and investigation examples; NVD controls the two vulnerability records.