Checklist · AI
AI Agent Security Checklist
Opens with creditsA security checklist for teams putting AI agents and MCP servers into production. It covers tool inventory and least privilege, authentication and authorization for MCP servers, prompt injection that arrives through tool output, human approval for risky actions, sandboxed code execution, secrets handling, logging and incident response, and the supply chain of the MCP servers your agents load, each with a severity and a way to verify it.
Written by Tauseef Fayyaz8 chapters, 37 checksAbout 22 minReviewed 13 October 2026What you will learn
8 chapters · about 22 min
1Tool inventory and least privilegeEvery tool an agent holds is something an attacker can make it use. These checks keep the tool set small, narrow and enforced in code.5 checks · 3 min
- 1List every tool each agent can call, with what it can read, change and reach
- 2Remove tools and functions the agent does not need for its task
- 3Give each agent its own credentials, scoped to its tools and to the acting user
- 4Validate tool arguments and enforce limits in code, not in the prompt
- 5Separate read tools from write tools so they can be granted and approved separately
5 in this chapterOpen this chapter2MCP server authentication and authorizationA remote MCP server is an API that a model drives. These checks apply the authorization rules and security best practices from the MCP specification.6 checks · 4 min
- 1Require authorization on every remote MCP server that reaches private data or actions
- 2Accept only tokens issued for your MCP server, and never pass client tokens downstream
- 3Start with a minimal scope set and request more only when a privileged tool is used
- 4If your server proxies a third-party API, enforce per-client consent and exact redirect URIs
- 5Bind state handles to the authenticated user and never treat them as authentication
- 6Keep local MCP servers off the network unless they require a token
6 in this chapterOpen this chapter- Prompt injection through tool outputAgent goal hijack is first on the OWASP agentic list. Most of it arrives through content the agent reads: tool results, documents, web pages and emails.6 checks · 4 minOpens with credits
- Human approval for risky actionsA person in the loop is the strongest control you have for actions that are hard to undo, but only if they can see what they are approving.4 checks · 2 minOpens with credits
- Sandboxing code executionUnexpected code execution is on the OWASP agentic list. Any agent that writes and runs code, or runs tools on a host, needs an isolated place to do it.4 checks · 2 minOpens with credits
- Secrets and sensitive dataAnything in an agent's context can end up in its output, its logs or a tool call. These checks keep secrets out of reach.3 checks · 2 minOpens with credits
- Logging, audit and incident responseWhen an agent misbehaves, you need to know what it did, stop it fast and keep one failure from spreading.4 checks · 2 minOpens with credits
- Supply chain of MCP servers and toolsAgentic supply chain vulnerabilities are on the OWASP list. Every MCP server, plugin and tool package you load runs with some of your agent's trust.5 checks · 3 minOpens with credits
About this checklist
An agent is a language model with hands. It reads content nobody on your team wrote, decides which tools to call, and acts with real credentials. That combination is why agent security is different from ordinary application security: the component making decisions can be talked into making the wrong ones, and it may hold the keys to do real damage when it does. This AI agent security checklist is about limiting what a confused or hijacked agent can reach, and noticing quickly when something goes wrong.
The checks follow two primary sources. The OWASP Top 10 for Agentic Applications, published by the OWASP GenAI Security Project in December 2025, names the risks: agent goal hijack, tool misuse and exploitation, identity and privilege abuse, agentic supply chain vulnerabilities, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents. The Model Context Protocol specification, version 2026-07-28, sets concrete MUST and SHOULD rules for MCP servers and clients, from token audience validation to how a client installs a local server.
You will not find a filter that reliably blocks prompt injection, and this checklist does not pretend otherwise. Its approach is defence in depth: fewer and narrower tools, credentials scoped to the task, a human in the loop for actions that are hard to undo, sandboxes with both filesystem and network limits, and logs good enough to reconstruct what an agent did and why.
Each check has a severity (must, should or nice) and a concrete way to verify it, such as a test to run, a configuration to read or a log query to try. If you are securing an agent that is already live, start with the must checks in the first four chapters.
Common questions
What is the biggest security risk with AI agents?
The OWASP Top 10 for Agentic Applications lists agent goal hijack first: instructions hidden in content the agent reads redirect what it does while it still appears to serve the user. Because no filter reliably stops it, the main defence is limiting what a hijacked agent can reach: narrow tools, scoped credentials, approval for risky actions and sandboxes.
Do MCP servers need authentication?
Authorization is optional in the MCP specification, but any remote server that reaches private data or performs actions should require it. For HTTP transports the specification defines an OAuth 2.1 based flow, and servers must validate that tokens were issued for them. Local servers should use stdio or require a token if they listen on HTTP.
What is token passthrough in MCP?
Token passthrough is when an MCP server accepts a token from a client and forwards it unchanged to a downstream API. The MCP specification forbids it because it bypasses audience checks, rate limits and audit trails. The server should only accept tokens issued for itself and use its own credentials, or exchanged tokens, downstream.
How do I stop prompt injection in an AI agent?
You cannot block it completely, so design for it. Treat every tool result as data, restrict write and send tools after the agent reads untrusted content, require approval with the exact arguments shown for risky actions, block quiet exfiltration channels like auto-loaded images, and keep injection cases in your regression tests.
Should AI agents run code in a sandbox?
Yes. Any model-written code should run with both filesystem isolation and network isolation, real credentials kept outside, resource limits and a fresh environment per task. Anthropic notes that either boundary alone is not enough, and that sandboxing also cut permission prompts in its coding agent.
Sources (8)
Checked against these, last on 13 October 2026.
- OWASP Top 10 for Agentic Applications for 2026, OWASP GenAI Security Projectgenai.owasp.org/resource/owasp-top-10-for-agentic-applications/
- Security Best Practices (MCP specification 2026-07-28), Model Context Protocolmodelcontextprotocol.io/specification/2026-07-28/basic/security_best_practices
- Authorization (MCP specification 2026-07-28), Model Context Protocolmodelcontextprotocol.io/specification/2026-07-28/basic/authorization
- Tools (MCP specification 2026-07-28), Model Context Protocolmodelcontextprotocol.io/specification/2026-07-28/server/tools
- LLM06:2025 Excessive Agency, OWASP GenAI Security Projectgenai.owasp.org/llmrisk/llm062025-excessive-agency/
- LLM Prompt Injection Prevention Cheat Sheet, OWASP Cheat Sheet Seriescheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html
- Making Claude Code more secure and autonomous with sandboxing, Anthropicwww.anthropic.com/engineering/claude-code-sandboxing
- OWASP Top 10 for LLM Applications 2026, OWASP GenAI Security Projectgenai.owasp.org/resource/owasp-genai-llm-top-10-2026/
Related on Sefism
Picked from the other libraries by shared topics.
Roadmaps
See allCheat sheets
See all- AI agents and MCP cheat sheetTool calling, MCP servers, evals.
- GenAI app architecture cheat sheetHow a production GenAI app fits together: request flow, layers, RAG, agent loop, memory, caching, guards, evals, tracing, folder layout and launch checklist.
- AI evals cheat sheetEvals for LLM apps and agents: golden datasets, metrics, LLM-as-judge and its biases, RAG and agent metrics, offline and online evals, CI, human review, tools.
Best practices
See all- Best Practices for Building AI AgentsHow to design AI agents that finish real tasks: when to use one, tool design, context and memory, control loops, MCP and agent security, and evaluating agent runs.
- Best Practices for Building LLM AppsHow to build LLM apps and agents that hold up in production: prompts, evals, prompt injection, tool permissions, cost, logging and privacy.
- Best Practices for AI Coding AssistantsHow to get reliable code from AI coding assistants and agents: instruction files, task prompts, verification, review, security, dependencies and session hygiene.
Checklists
See allProject structures
See all- AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Python AI agent with LangGraph project structureFor Python developers moving from "call a model in a loop" to an agent that can pause, resume and be debugged. It starts from the official LangGraph template (langgraph.json, a src/agent package, unit and integration tests) and grows into a customer support agent with typed state, one file per node and tool, human approval before refunds, evals that score whole trajectories, tracing, auth and a deployable server image.
Career questions
See all- How do I start learning AI agents as a software engineer?Start with one LLM API and plain code: a loop that calls the model, lets it pick a tool, runs the tool and feeds the result back. Build one small agent that does a real task end to end, add evaluation and guardrails, and only then reach for a framework. Agents are software engineering first.
- Should I learn LangGraph, CrewAI or the OpenAI Agents SDK first, or build AI agents without a framework?Build one small agent without a framework first: the tool-calling loop is about fifty lines and every framework wraps it. Then learn one framework deeply, chosen by what your project needs: LangGraph for explicit state and approvals, the OpenAI Agents SDK for quick assistants with handoffs, the Claude Agent SDK for agents that work on files.
- What is MCP, and do I need to learn it?MCP, the Model Context Protocol, is an open standard for connecting AI applications to tools and data. You do not need to study it in depth, but if you build with LLMs, writing one small MCP server takes an afternoon and teaches you how agents really use tools. Learn the concepts; skip the hype.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com