The MCP Security & Verification Checklist: How to Audit Agent Tools Before Installing
Defending autonomous agents against indirect prompt injection, tool poisoning, credential exfiltration, and unscoped OAuth tokens.
Before connecting a third-party MCP server or SKILL.md playbook to your production workspace, run this 7-point security verification checklist.
Verified Capabilities Benchmarked in This Guide
Inspect Live JSON Feed ↗LeakPatrol MCP — Real-Time Secret Scanning & Prompt-Exfiltration Firewall
Scan agent tool outputs, outbound HTTP requests, and git commits in real time to block API key leakage, PII exfiltration, and indirect prompt injection.
OpenZiti Zero-Trust Overlay Network Gateway for Private MCP Servers
Reach internal VPC databases and private stdio/HTTP MCP servers without opening inbound firewall ports using OpenZiti mutual-TLS zero-trust tunnels.
Unbound AI — Enterprise MCP Policy Governance, DLP & Audit Gateway
Enforce granular RBAC policies, PII redaction, and human-approval rules across every MCP server and AI coding agent in your engineering organization.
LLM Indirect Prompt Injection & Untrusted Data Fencing Skill
Defend autonomous agents against indirect prompt injection in emails, web pages, and MCP tool outputs using XML data fencing, privilege separation, and hum
Cloudflare Turnstile Bot Verification & Siteverify Skill
Implement privacy-preserving Cloudflare Turnstile challenge widgets on frontend forms with mandatory server-side Siteverify token validation and replay pro
Inbox Injection Guard — Prompt-Injection & Phishing Firewall
Screens inbound emails, attachments, and webhook payloads for hidden prompt injections, spoofed headers, and credential-harvesting links before other bots
1. Auditing Tool Descriptions for Hidden Prompt Injections
Untrusted MCP tool schemas and external API responses must be treated as data, never instructions. Gateways like OpenZiti MCP Gateway, Unbound AI, and LeakPatrol MCP inspect tool payloads for secret leakage and policy violations.
2. Enforcing Read-Only vs Ask-First vs Autonomous Tiers
LightState classifies every capability into Read-Only / Ask-First safety levels so humans and bots know exactly which permissions are required before installation.
Frequently Asked Questions
What do LightState safety badges mean?
Read-Only tools only fetch data; Ask-First tools draft or stage changes for human approval; Autonomous tools execute within pre-authorized sandboxes.