Pillar

Security Engineering

Threat models, trust boundaries and controls for systems that hold credentials, execute code and call tools on your behalf.

01

Auditing Agent Tool Calls: Logging That Survives an Incident

Six fields worth recording per tool call, why arguments matter more than tool names, four alert rules that produce few false positives, and why the log pays for itself before any incident.

02

Prompt Injection Through Tool Descriptions and Tool Output

Tool descriptions are attacker-supplied text sitting in the same context as your instructions. Where hostile content enters, why filtering fails, and four controls that limit the damage.

03

Credential Boundaries: What an Agent Should Never Be Able to See

The difference between an agent seeing a secret and using one, why wrapper scripts beat environment variables, and how to scope agent credentials so a steered session stays contained.

04

Shell Execution and Blast Radius: What an Agent Can Actually Reach

Granting shell access grants everything the shell reaches. What that includes on a typical laptop, four levels of containment, and why command allow-lists don't hold.

05

AI Gateways and Data Retention: Enforcing Policy in the Request Path

What zero data retention actually guarantees, why a gateway turns per-developer configuration into a real control, routing by data classification, and the limits of redaction.

06

Hardening the Local Toolchain: Prompt Injection on a Developer Machine

Where untrusted text enters an agent's context on your own laptop, four controls ordered by return, and the session split that turns a possible compromise into a contained one.

07

Multi-Tenant Codebases: Make the Unsafe Query Impossible to Write

Why tenant isolation cannot rest on instructions, binding tenant from request context rather than arguments, the surfaces that leak besides queries, and a test that covers endpoints added later.

08

Gating Irreversible Actions: Controls That Don't Depend on the Model

Sorting agent actions by reversibility and visibility, why the strongest control is simply not granting the credential, and the limits of confirmation prompts.

09

Capability Attestation and Tool Poisoning: Trusting What a Server Claims

MCP has no way to verify a server does what it declares, and tool definitions are re-fetched every connection. How to pin them, review them, and contain what a server can reach.

10

Reviewing Third-Party MCP Servers Before You Install Them

A tiered review process short enough to actually run: publisher, source, behaviour and descriptions, plus the pinning and containment that keep working when the review was wrong.

11

Securing a Local Agent Daemon: Loopback Is Not a Boundary

Why an unauthenticated daemon on 127.0.0.1 is reachable by every process running as you, token files and ephemeral ports, path traversal, and constraining what it will do regardless of caller.

12

The MCP Threat Model: Where Trust Actually Breaks Down

Why the Model Context Protocol attracted 30+ CVEs and a DoD advisory within eighteen months: three protocol-level weaknesses, and why the whole context window is one trust domain.

13

Unauthenticated Sampling: When an MCP Server Drives Your Model

MCP sampling lets a server request completions on your account, inverting the usual direction of control. Why it is a documented attack vector and how to constrain it.

14

Implicit Trust Propagation: Why Provenance Dies in the Context Window

Content loses its origin the moment it enters the context, and tool chains launder it further. The tainted-session model, and how to split research from action.

Other pillars