AI & MCP

The instruction

The AI, agent, and MCP family is one of the 21 catalog families. It is reviewed with the same evidence contract as injection or authorization: a model behaving oddly is a candidate, not a finding.

Use SecHelix to audit AI/LLM/agent/MCP security.
Map prompt/context sources, RAG/vector stores, memory, tool calls, MCP servers, external content,
DB/file/shell/browser permissions, and autonomous side effects.
Check prompt injection, tool authorization, unsafe output reaching sinks, cross-user leakage,
memory poisoning, SSRF through tools, excessive agency, and plugin/model/tool supply-chain risk.

What to map

Prompt and context sources

System prompts, user input, retrieved documents, tool output, file contents, and anything an external party can influence.

Retrieval and memory

RAG stores, vector indexes, conversation memory, and persisted summaries. Each is a place stored instructions can survive between sessions and between users.

Tool surface

Every tool the agent can call, the arguments it controls, the identity the call runs as, and the scope that identity carries.

MCP servers

Which servers are reachable, what authorization they enforce, and whether the agent identity is distinguishable from the end-user identity.

Autonomous side effects

Actions the agent can take without a human confirmation step, especially writes, purchases, deletions, and outbound requests.

Failure classes

• Direct and indirect prompt injection, including instructions stored in retrieved content.
• Tool argument authorization: whether the boundary checks the requested object, not only the requested tool.
• Unsafe model output reaching a sink — shell, SQL, HTML, filesystem path, or outbound URL.
• Cross-user leakage through shared memory, shared caches, or shared vector namespaces.
• Memory and context poisoning that persists past the session that introduced it.
• SSRF through tools that fetch operator-supplied or model-supplied URLs.
• Excessive agency: the agent can do more than the task requires, and more than the user could do directly.
• Tool, plugin, and model supply-chain risk.

Evidence rules for AI findings

The same nine evidence links apply. For an agent finding that usually means naming the untrusted content source, the tool call it reaches, the authorization decision it bypasses, and a bounded reproduction that does not exfiltrate real data.

• Instruction provenance has to be traced, not assumed. Which text entered the context, and from where?
• Tool scope accuracy matters more than model behaviour. An overprivileged tool is a finding even when no prompt currently abuses it.
• A refused request is not a control. The control is the authorization check behind the tool.

AI-built code

Built with AI is not itself a vulnerability class. Code generated by a model is reviewed for the same defects as any other code: missing server-side authorization, client-controlled identity and price fields, dynamic queries, unsafe HTML, SSRF, weak upload validation, permissive CORS, home-grown auth and JWT logic, missing replay and idempotency controls, unsafe logs, source-map exposure, and overprivileged agent tools.