Connect product agents only to tools and servers on a reviewed list

How to do it

Every connected tool is a way in and a way out. Its description and results reach the model as text that can carry instructions. Keep the list in the model gateway settings, with the server address, the version and a hash of each tool description. Refuse a server whose descriptions changed until a person reviews them. Give each server its own keys, so one bad server cannot use another's. Coding agents follow Allow only listed MCP servers instead. Treat every tool result as data, as resist indirect prompt injection says. Give each tool the least power it needs, as give agent tools the least power they need says. Never combine private data, untrusted content and a way to send data out in one run, as break the lethal trifecta explains.

Examples

TypeScript example

const toolList: Record<string, { url: string; version: string; descriptionHash: string }> = JSON.parse(readFileSync('ai/tools.json', 'utf8'));

export function assertReviewedServer(name: string, version: string, descriptions: string) {
  const entry = toolList[name];
  if (!entry || entry.version !== version || entry.descriptionHash !== sha256(descriptions)) throw new ToolNotReviewed(name);
}

Python example

TOOL_LIST = json.loads(Path("ai/tools.json").read_text())

def assert_reviewed_server(name: str, version: str, descriptions: str) -> None:
    entry = TOOL_LIST.get(name)
    if not entry or entry["version"] != version or entry["description_hash"] != sha256(descriptions):
        raise ToolNotReviewed(name)

How to check

A test connects the agent to a server missing from the list and to a listed server whose tool description changed. Both are refused. A search of the agent code finds no service-account token passed to a tool call.

Sources

• MCP security best practices
• OWASP LLM01:2026 Prompt Injection

Related rules

• AID-28 Treat what the agent reads as untrusted in AI-assisted development
• AID-30 Review agent settings like code in AI-assisted development
• AID-74 Allow only listed MCP servers and pin each one to an exact version in AI-assisted development
• AID-57 Keep project skills in the repository and review them like code in AI-assisted development
• AIF-4 Call models through one module in AI features
• APS-83 Resist indirect prompt injection in Application security
• APS-85 Give agent tools the least power they need in Application security
• APS-84 Break the lethal trifecta in Application security
• AGT-61 Publish a server card for your MCP server in Agents as users
• AGT-63 List skills agents can learn in Agents as users