AI Agent Security Checklist

What this checklist is

A security checklist for teams putting AI agents and MCP servers into production. It covers tool inventory and least privilege, authentication and authorization for MCP servers, prompt injection that arrives through tool output, human approval for risky actions, sandboxed code execution, secrets handling, logging and incident response, and the supply chain of the MCP servers your agents load, each with a severity and a way to verify it.

It has 8 chapters and 37 checks, each with how to verify it and how much it matters. For developers shipping agents, tools and MCP servers.

Chapter by chapter

1. Tool inventory and least privilege (5 checks)

Every tool an agent holds is something an attacker can make it use. These checks keep the tool set small, narrow and enforced in code.

2. MCP server authentication and authorization (6 checks)

A remote MCP server is an API that a model drives. These checks apply the authorization rules and security best practices from the MCP specification.

3. Prompt injection through tool output (6 checks)

Agent goal hijack is first on the OWASP agentic list. Most of it arrives through content the agent reads: tool results, documents, web pages and emails.

4. Human approval for risky actions (4 checks)

A person in the loop is the strongest control you have for actions that are hard to undo, but only if they can see what they are approving.

5. Sandboxing code execution (4 checks)

Unexpected code execution is on the OWASP agentic list. Any agent that writes and runs code, or runs tools on a host, needs an isolated place to do it.

6. Secrets and sensitive data (3 checks)

Anything in an agent's context can end up in its output, its logs or a tool call. These checks keep secrets out of reach.

7. Logging, audit and incident response (4 checks)

When an agent misbehaves, you need to know what it did, stop it fast and keep one failure from spreading.

8. Supply chain of MCP servers and tools (5 checks)

Agentic supply chain vulnerabilities are on the OWASP list. Every MCP server, plugin and tool package you load runs with some of your agent's trust.

How it works on Sefism

The checklist is one page: each check has a severity (must, should or nice to have) and a concrete way to verify it, and members can tick checks off as they go. The opening chapters are open to everyone. Adding it to your account uses credits, opens every chapter and keeps your progress.

Every claim is checked against the sources listed on the page (8 cited).