AI Agent Security Checklist: Tools, Memory, RAG, and MCP
An AI agent is more than a model. It combines instructions, retrieved data, memory, identity, tools, and an execution loop. Security failures happen when natural-language output is trusted as authorization or executable intent.
Use this checklist during architecture reviews and authorized testing.
1. Give the agent its own identity
Do not let an agent inherit a developer's broad API key or a user's entire session. Give each agent a service identity with explicit scopes, short-lived credentials, and tenant boundaries. Log which human, agent, and tool participated in every sensitive action.
For MCP servers and plugins, inventory every exposed tool. Tool descriptions are not access controls; the server must enforce authorization on each call.
2. Treat all context as untrusted
User prompts are only one input. Web pages, documents, emails, database records, repository files, tool output, and previous memory can all contain indirect instructions.
Label their origin, delimit untrusted content, and prevent retrieved text from silently becoming system instructions. Scan both input and output, but assume filtering can fail.
3. Minimize tool power
Prefer narrow tools such as get_invoice_status(id) over generic SQL, shell, filesystem, or unrestricted HTTP tools. Validate arguments with a strict schema, enforce allowlists in code, and reject unknown fields.
Separate read and write capabilities. An agent that summarizes email should not automatically send email. A coding assistant that reads a repository should not automatically access cloud production credentials.
4. Add approval at irreversible boundaries
Require a human confirmation for sending messages, changing permissions, spending money, deleting data, publishing content, or executing code outside a sandbox. The confirmation screen should show the exact normalized action—not a model-written summary that could hide details.
Bind approval to one action and expire it quickly. Do not let a previous “yes” authorize a modified request.
5. Isolate memory and retrieval
Partition vector stores, conversation memory, and caches by tenant and user. Enforce filters in the data layer, not in a prompt. Test whether identifiers, embeddings, shared caches, or background summaries can cross those boundaries.
Store the minimum necessary memory and give users a way to inspect and delete it. Sensitive values should not be embedded into long-lived stores by default.
6. Constrain execution
Run generated code in an isolated sandbox with no implicit secrets, restricted networking, filesystem quotas, CPU and time limits, and disposable state. Treat model output as untrusted input to the executor.
For HTTP tools, block private networks and cloud metadata addresses, validate redirects, and use destination allowlists where possible.
7. Validate outputs deterministically
If downstream code expects JSON, validate it against a schema. Parameterize database queries. Escape content for its final HTML, shell, URL, or template context. Never execute text merely because the model labeled it “safe.”
8. Monitor behavior and contain failures
Record tool name, arguments, authorization decision, result class, and policy version while redacting secrets. Alert on unusual tool sequences, repeated denials, cross-tenant identifiers, large exports, and unexpected destinations.
Create an emergency control that can disable a tool, revoke agent credentials, and stop queued actions without taking the whole product offline.
Security test cases
- Direct and indirect prompt injection through every content channel.
- Cross-user memory and retrieval access.
- Unauthorized tool calls and argument substitution.
- Approval replay or action changes after approval.
- SSRF through browsing and connector tools.
- Secret exposure in prompts, logs, errors, and traces.
- Resource exhaustion through loops or oversized context.
- Compromised or malicious MCP/tool servers.
The core design rule
Assume the model can be manipulated. A secure architecture still prevents data access and actions that the current user and agent identity are not authorized to perform.
Original Bugflare checklist based on OWASP's AI Agent Security Cheat Sheet and LLM security verification guidance.