AG1Assure AI agent scope
MCP server and tool-chain audit
A close audit of the MCP servers and tools your agents use: how they authorise, what they can reach, how they install, and whether their descriptions can be turned against you.
Price on requestAsk about AG1How pricing works
What it is for
The Model Context Protocol connects agents to tools and data. Each MCP server is code with access to something you care about, and each one is a door. AG1 inspects the doors.
What we look at
- Inventory: every server in use, local and remote, who published it, which version, and who approved it.
- Authorization: the MCP authorization specification builds on OAuth 2.1 and requires servers to publish OAuth 2.0 Protected Resource Metadata (RFC 9728) and to accept only tokens issued for them.[1][2] We check audience validation, token passthrough, client registration and scope design.
- Known attack classes: confused deputy, token passthrough, server-side request forgery during OAuth discovery, state handle hijacking, local server compromise through startup commands, and over-broad scopes, each with the mitigations the best practices give.[3]
- Tool poisoning: whether a tool’s description or output can carry instructions your agent will follow. The specification treats tool annotations as untrusted unless the server is trusted.[4]
- Installation: how servers are installed and updated. In September 2025 a malicious package impersonating a legitimate MCP server quietly copied every email sent through it to an attacker.[5]
What you receive
A server inventory with a verdict on each, an authorization review, the results of SSRF, installation and tool-poisoning tests, and findings mapped under the TriOngle Method.
Framework mapping
The frameworks this scope is aligned with, the version we map to, and what we map. Aligned with means we use the framework; it does not mean any body has certified TriOngle.
| Framework | Version | What we map |
|---|---|---|
| MCP specification and Security Best Practices | Specification 2026-07-28[4][3] | Every attack and mitigation in the security best practices |
| MCP Authorization | Specification 2026-07-28[1] | OAuth 2.1, protected resource metadata, resource indicators |
| OWASP Top 10 for Agentic Applications | 2026 edition, 9 Dec 2025[6] | ASI02 Tool Misuse and Exploitation; ASI04 Agentic Supply Chain Vulnerabilities |
| OWASP MCP Top 10 | Beta[7] | MCP01 to MCP10 |
| CoSAI Model Context Protocol security taxonomy | 27 Jan 2026[8] | Threat categories in the taxonomy |