MCP and AI agent security

The scanner introspects tools, resources and prompts. It inspects declarations without invoking target tools. Protocol connections still occur; stdio mode launches the configured local server.

Detectors check suspicious instructions and credential references, hidden Unicode, sensitive parameters and manifest changes. A flagged tool needs implementation review before claiming exploitability.

The code includes bounded MCP probes for authorisation, injection and resource amplification, plus agent-endpoint probes for indirect injection and canary disclosure. These may invoke tools or send adversarial messages.

Hosted availability depends on feature flags, entitlements, account policy and target gates. Confirm deployment availability and explicit testing scope before an engagement. Implemented code is not evidence that a feature is enabled everywhere.

Static inspection cannot establish whether an egress policy, sandbox, OAuth permission or approval flow works at runtime. A benign declaration may conceal an unsafe implementation; a sensitive parameter may be safely implemented.

Pentriarch is not a universal runtime firewall. Third-party patches remain the responsibility of the vendor and system owner. Define a testable boundary and review the observed evidence.