---
title: "Connect product agents only to tools and · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools
id: AIF-73
level: Recommended
applies: ai-features
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1530
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Connect product agents only to tools and servers on a reviewed list

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Agents in products](https://agentwranglers.se/playbook/ai-features/agents-in-products.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AIF-73
- Level: Recommended
- Chapter: [Agents in products](https://agentwranglers.se/playbook/ai-features/agents-in-products.md)
- Rule: Let an agent in your product call only tools and MCP servers on a list in version control, each pinned to a version. Call them with the signed-in user's own token, never a shared admin key.
- Check: A test connects the agent to a server missing from the list and to a listed server whose tool description changed. Both are refused. A search of the agent code finds no service-account token passed to a tool call.
- Applies when: The project uses AI models.
- How: Every connected tool is a way in and a way out. Its description and results reach the model as text that can carry instructions. Keep the list in the [model gateway](https://agentwranglers.se/playbook/ai-features/deciding-to-use-a-model/model-gateway.md) settings, with the server address, the version and a hash of each tool description. Refuse a server whose descriptions changed until a person reviews them. Give each server its own keys, so one bad server cannot use another's. Coding agents follow [Allow only listed MCP servers](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-server-allow-list.md) instead. Treat every tool result as data, as [resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md) says. Give each tool the least power it needs, as [give agent tools the least power they need](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/least-privilege-tools.md) says. Never combine private data, untrusted content and a way to send data out in one run, as [break the lethal trifecta](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta.md) explains.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### TypeScript example

```ts
const toolList: Record<string, { url: string; version: string; descriptionHash: string }> = JSON.parse(readFileSync('ai/tools.json', 'utf8'));

export function assertReviewedServer(name: string, version: string, descriptions: string) {
  const entry = toolList[name];
  if (!entry || entry.version !== version || entry.descriptionHash !== sha256(descriptions)) throw new ToolNotReviewed(name);
}
```

### Python example

```python
TOOL_LIST = json.loads(Path("ai/tools.json").read_text())

def assert_reviewed_server(name: str, version: str, descriptions: str) -> None:
    entry = TOOL_LIST.get(name)
    if not entry or entry["version"] != version or entry["description_hash"] != sha256(descriptions):
        raise ToolNotReviewed(name)
```

## Sources

- [MCP security best practices](https://modelcontextprotocol.io/specification/2026-07-28/basic/security_best_practices)
- [OWASP LLM01:2026 Prompt Injection](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM01_PromptInjection.md)

## Related rules

- AID-28 [Treat what the agent reads as untrusted](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/untrusted-context.md) in AI-assisted development
- AID-30 [Review agent settings like code](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/review-agent-config.md) in AI-assisted development
- AID-74 [Allow only listed MCP servers and pin each one to an exact version](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-server-allow-list.md) in AI-assisted development
- AID-57 [Keep project skills in the repository and review them like code](https://agentwranglers.se/playbook/ai-assisted-development/agent-skills/project-skills-in-repo.md) in AI-assisted development
- AIF-4 [Call models through one module](https://agentwranglers.se/playbook/ai-features/deciding-to-use-a-model/model-gateway.md) in AI features
- APS-83 [Resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md) in Application security
- APS-85 [Give agent tools the least power they need](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/least-privilege-tools.md) in Application security
- APS-84 [Break the lethal trifecta](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta.md) in Application security
- AGT-61 [Publish a server card for your MCP server](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/mcp-and-tool-discovery.md) in Agents as users
- AGT-63 [List skills agents can learn](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/agent-skills-discovery.md) in Agents as users

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools">Agent Wranglers AI features playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Give each sub-agent no more power than the agent that started it](https://agentwranglers.se/playbook/ai-features/agents-in-products/sub-agent-limits.md)
- Next: [Run browser and computer-use agents in a throwaway session](https://agentwranglers.se/playbook/ai-features/agents-in-products/isolated-browser-agents.md)
- [Agents in products](https://agentwranglers.se/playbook/ai-features/agents-in-products.md)